{% extends "base.html" %} {% load display_tags %} {% load multiply %} {% load authorization_tags %} {% load humanize %} {% load static %} {% load i18n %} {% block add_styles %} {{ block.super }} {% endblock %} {% block add_css_before %} {{ block.super }} {% endblock %} {% block content %} {{ block.super }} {% user_can_clear_peer_review finding dojo_user as clear_peer_review %}

{{ finding.title }} {% include "dojo/snippets/tags.html" with tags=finding.tags.all %} {% if finding.last_reviewed %} Last Reviewed {{ finding.last_reviewed | naturalday }} by {{ finding.last_reviewed_by }}, {% else %} Last Reviewed {{ finding.date | naturalday }} by {{ finding.reporter }}, {% endif %} {% if finding.last_status_update %} Last Status Update {{ finding.last_status_update | naturalday }}, {% endif %} Created {% if finding.last_reviewed > finding.created %} {{ finding.created | naturalday }} {% else %} {{ finding.date | naturalday }} {% endif %} {% if latest_test_import_finding_action %} , Last Mentioned in (Re)Import: {{ latest_test_import_finding_action.created | naturalday }} as {{ latest_test_import_finding_action.get_action_display }} {% endif %}

{% if finding.under_review %} {% endif %} {% if finding.under_defect_review %} {% endif %} {% block header_head %} {% if system_settings.enable_finding_sla %} {% endif %} {% if finding.scanner_confidence %} {% endif %} {% if finding.risk_acceptance_set.all %} {% endif %} {% if finding.duplicate_finding %} {% endif %} {% if duplicate_cluster and not finding.duplicate %} {% elif duplicate_cluster and finding.duplicate %} {% endif %} {% if finding.publish_date %} {% endif %} {% if finding.planned_remediation_date %} {% endif%} {% if finding.planned_remediation_version %} {% endif %} {% if finding.mitigated %} {% endif %} {% if finding.epss_score != None or finding.epss_percentile != None %} {% if finding.epss_score != None and finding.epss_percentile != None %} {% elif finding.epss_score != None and finding.epss_percentile == None %} {% elif finding.epss_score == None and finding.epss_percentile != None %} {% endif %} {% endif %} {% if finding.vuln_id_from_tool %} {% endif %} {% endblock header_head %} {% block header_body %} {% if system_settings.enable_finding_sla %} {% endif %} {% if finding.scanner_confidence %} {% endif %} {% if finding.risk_acceptance_set.all %} {% endif %} {% if finding.duplicate_finding %} {% endif %} {% if duplicate_cluster %} {% endif %} {% if finding.publish_date %} {% endif %} {% if finding.planned_remediation_date %} {% endif %} {% if finding.planned_remediation_version %} {% endif %} {% if finding.mitigated %} {% endif %} {% if finding.epss_score != None or finding.epss_percentile != None %} {% if finding.epss_score != None and finding.epss_percentile != None %} {% elif finding.epss_score != None and finding.epss_percentile == None %} {% elif finding.epss_score == None and finding.epss_percentile != None %} {% endif %} {% endif %} {% endwith %} {% if finding.vuln_id_from_tool %} {% endif %} {% endblock header_body %}
Alert: This Finding is under review and may not be 100% accurate. {% if finding|has_object_permission:"edit" and clear_peer_review %} [Clear Review] {% endif %}
Alert: Please review this finding to verify if the defect is remediated. [Review Finding for Closure]
ID SeveritySLAScanner ConfidenceStatusRisk AcceptanceOriginalDuplicatesDuplicate ClusterType Date discovered AgeVuln Publish datePlanned Remediation{% trans "Planned Remediation version" %}ReporterDate Mitigated Mitigated ByCWE Vulnerability IdEPSS Score / PercentileEPSS ScoreEPSS PercentileFound byVuln ID from tool
{{ finding.id }} {% if finding.severity %} {{ finding.severity_display }} {% if system_settings.enable_cvss4_display and finding.cvssv4_score or system_settings.enable_cvss3_display and finding.cvssv3_score %} ({% if system_settings.enable_cvss4_display and finding.cvssv4_score %}{{ finding.cvssv4_score }}{% if system_settings.enable_cvss3_display and finding.cvssv3_score %}, {% endif %}{% endif %}{% if system_settings.enable_cvss3_display and finding.cvssv3_score %}{{ finding.cvssv3_score }}{% endif %}) {% endif %} {% else %} Unknown {% endif %} {{ finding|finding_sla }} {{finding.get_scanner_confidence_text}} {% comment %} {% if finding.duplicate %} {% include "dojo/finding_related_actions.html" with similar_finding=finding finding_context=finding intro=finding|finding_display_status|safe %} {% else %} {{ finding|finding_display_status|safe }} {% endif %} {% endcomment %} {{ finding|finding_display_status|safe }}  {{ finding|import_history }} {% for ra in finding.risk_acceptance_set.all|slice:":5" %} {% endfor %}
{% if finding.static_finding and finding.dynamic_finding > 0 %} Static/Dynamic {% elif finding.static_finding > 0 %} Static {% else %} Dynamic {% endif %} {{ finding.date }} {{ finding.age }} days{{ finding.publish_date }}{{ finding.planned_remediation_date }}{{ finding.planned_remediation_version }}{{ finding.reporter }}{{ finding.mitigated }} {{ finding.mitigated_by }} {% if finding.cwe > 0 %} {{ finding.cwe }} {% endif %} {% with finding|first_vulnerability_id as first_vulnerability_id %} {% if first_vulnerability_id %} {% if first_vulnerability_id|has_vulnerability_url %} {{ first_vulnerability_id }} {% else %} {{ first_vulnerability_id }} {% endif %} {% endif %} {{ finding.epss_score|multiply:100|floatformat:"2" }}% / {{ finding.epss_percentile|multiply:100|floatformat:"2" }}%{{ finding.epss_score|multiply:100|floatformat:"2" }}%{{ finding.epss_percentile|multiply:100|floatformat:"2" }}% {% if found_by %} {% for scanner in found_by %} {{ scanner }} {% endfor %} {% else %} {{ finding.test.test_type }} {% endif %} {{ finding.vuln_id_from_tool }}
{% with finding|additional_vulnerability_ids as additional_vulnerability_ids %} {% if additional_vulnerability_ids %}
Additional Vulnerability Ids
{% for vulnerability_id in additional_vulnerability_ids %} {% if vulnerability_id|has_vulnerability_url%} {{ vulnerability_id }} {% else %} {{ vulnerability_id }} {% endif %} {% if not forloop.last %}, {% endif %} {% endfor %}
{% endif %} {% endwith %} {% with finding.cwes|slice:"1:" as additional_cwes %} {% if additional_cwes %}
Additional CWEs
{% for cwe in additional_cwes %} {{ cwe }} {% if not forloop.last %}, {% endif %} {% endfor %}
{% endif %} {% endwith %} {% if finding.static_finding or finding.line > 0 %} {% if finding.sast_source_object or finding.sast_sink_object or finding.sast_source_file_path or finding.sast_source_line > 0 %} {# For tools that give information on both source (start) and sink (end) of the attack vector #}
Source Filepath Source Line Number Source Object
{{ finding.get_sast_source_file_path_with_link|safe }} {{ finding.sast_source_line }} {{ finding.sast_source_object }}
Sink Filepath Sink Line Number Sink Object
{{ finding.get_file_path_with_link|safe }} {{ finding.line }} {{ finding.sast_sink_object }}
{% endif %} {% endif %} {% if finding.service or finding.file_path or finding.line > 0 or finding.has_jira_configured or finding.has_jira_issue or finding.github_issue or finding.github_conf_new or finding.finding_group or finding.component_name or finding.nb_occurences > 1 %}
{% if finding.file_path %} {% endif %} {% if finding.line %} {% endif %} {% if finding.nb_occurences > 1 %} {% endif %} {% if finding.component_name %} {% endif %} {% if finding.component_version %} {% endif %} {% if finding.fix_available %} {% endif %} {% if finding.fix_version %} {% endif %} {% if finding.has_jira_configured or finding.jira_issue %} {% endif %} {% if finding.github_conf_new or finding.github_issue %} {% endif %} {% if 'is_finding_groups_enabled'|system_setting_enabled and finding.finding_group %} {% endif %} {% if finding.effort_for_fixing %} {% endif %} {% if finding.file_path %} {% endif %} {% if finding.line %} {% endif %} {% if finding.nb_occurences > 1 %} {% endif %} {% if finding.component_name %} {% endif %} {% if finding.component_version %} {% endif %} {% if finding.fix_available %} {% endif %} {% if finding.fix_version %} {% endif %} {% if finding.has_jira_configured or finding.has_jira_issue or finding.has_jira_group_issue %} {% endif %} {% if finding.github_conf_new or finding.github_issue %} {% endif %} {% if 'is_finding_groups_enabled'|system_setting_enabled and finding.finding_group %} {% endif %} {% if finding.effort_for_fixing %} {% endif %}
ServiceLocationLine NumberNb occurencesComponent NameComponent VersionFix AvailableFixed VersionJIRA JIRA ChangeGitHubGroup{% trans "Effort for fixing" %}
{{ finding.service }} {{ finding.get_file_path_with_link|safe }} {{ finding.line }} {{ finding.nb_occurences }} {{ finding.component_name }} {{ finding.component_version }} {{ finding.fix_available }} {{ finding.fix_version }} {% if finding.has_jira_group_issue %} {{ finding.finding_group | jira_key }} {% endif %} {% if finding.has_jira_issue %} {{ finding | jira_key }} {% else %} {% if can_be_pushed_to_jira %} {% if not finding.has_jira_group_issue %} None {% comment %} {% endcomment %} {% endif %} {% else %} {% endif %} {% endif %} {% if finding.has_jira_group_issue %}
{{ finding.finding_group.jira_issue.jira_change|naturalday }}
{% elif finding.jira_issue %}
{{ finding.jira_issue.jira_change|naturalday }}
{% endif %}
{% if finding.github_issue %} #{{ finding.github_issue.issue_id }} {% endif %} {{ finding.finding_group.name }} {{ finding.effort_for_fixing }}
{% endif %} {% if finding.param or finding.payload %}
{% if finding.payload %} {% endif %} {% if finding.payload %} {% endif %}
Injected Parameter(s)Payload
{{ finding.param|default_if_none:"" }} {{ finding.payload|default_if_none:"" }}
{% endif %} {% if finding.duplicate_finding_set %} {% comment %} little extra div to serve as anchor, with some padding and padding cancelling margin to make sure it scrolls into view correctly {% endcomment %}

Duplicate Cluster ({{ finding|finding_duplicate_cluster_size }})

{% if finding.duplicate_finding %} {% include "dojo/finding_related_list.html" with finding_context=finding finding_first_related=finding.duplicate_finding finding_list=duplicate_cluster prefix='duplicate' %} {% else %} {% include "dojo/finding_related_list.html" with finding_context=finding finding_first_related=finding finding_list=duplicate_cluster prefix='duplicate' %} {% endif %}
{% endif %} {% if similar_findings_enabled %}

Similar Findings ({{ similar_findings.paginator.count }})  

{% url 'view_finding' finding.id as finding_url %} {% include "dojo/filter_snippet.html" with form=similar_findings_filter.form form_id="similar" clear_js=True restart_link=finding_url %}
{% if similar_findings_filter %}
{% include "dojo/finding_related_list.html" with finding_context=finding finding_list=similar_findings prefix='similar' %}
{% endif %}
{% endif %} {% comment %} Add a form to (ab)use to submit any actions related to similar/duplicates as POST requests {% endcomment %} {% if 'TRACK_IMPORT_HISTORY'|setting_enabled and latest_test_import_finding_action %}

{% trans "Import History" %} ({{ test_import_finding_actions_count }})

{% include "dojo/filter_snippet.html" with form=test_import_filter.form %} {% include "dojo/filter_snippet.html" with form=test_import_finding_action_filter.form %}
{% if paged_test_import_finding_actions %} {% for test_import_finding_action in paged_test_import_finding_actions %} {% endfor %}
{% trans "Action" %} {% trans "Date/Time" %} {% trans "Import Type" %} {% trans "Branch/Tag" %} {% trans "Build ID" %} {% trans "Commit" %} {% trans "Version" %} {% trans "Endpoint" %}
{{ test_import_finding_action.get_action_display }} {{ test_import_finding_action.test_import.created|date:"DATETIME_FORMAT" }} {{ test_import_finding_action.test_import|import_settings_tag }} {{ test_import_finding_action.test_import.type }} {{ test_import_finding_action.test_import.branch_tag|default_if_none:"" }} {{ test_import_finding_action.test_import.build_id|default_if_none:"" }} {{ test_import_finding_action.test_import.commit_hash|default_if_none:"" }} {{ test_import_finding_action.test_import.version|default_if_none:"" }} {% if V3_FEATURE_LOCATIONS %} {{ test_import_finding_action.test_import.import_settings.locations|default_if_none:"" }} {% else %} {% comment %} TODO: Delete this after the move to Locations {% endcomment %} {{ test_import_finding_action.test_import.import_settings.endpoint|default_if_none:"" }} {% endif %}
{% else %}

{% trans "No import history found." %}

{% endif %}
{% include "dojo/paging_snippet.html" with page=paged_test_import_finding_actions prefix='test_import_finding_actions' page_size=True %}
{% endif %} {% include "dojo/snippets/endpoints.html" with finding=finding destination="UI" %}

Description

{{ finding.description|markdown_render|default_if_none:"" }}
{% if files %}

Files

{% for file in files %}
{% url 'access_file' fid=file.id oid=finding.id obj_type='Finding' as image_url %} {% if file|get_thumbnail %} {% trans 'thumbnail' %} {% else %} {% endif %}
{{ file.title }}
{% endfor %}
{% endif %}

Mitigation

{{ finding.mitigation|markdown_render|default_if_none:"" }}
{% if finding.burprawrequestresponse_set.all %}

Request / Response Pairs

{% for req_resp in finding.burprawrequestresponse_set.all %}

Request #{{ forloop.counter }}

{{ req_resp.get_request }}

Response #{{ forloop.counter }}

{{ req_resp.get_response }}
{% endfor %}
{% endif %}

Impact

{{ finding.impact|markdown_render|default_if_none:"" }}

Steps To Reproduce

{{ finding.steps_to_reproduce|markdown_render|default_if_none:"" }}

Severity Justification

{{ finding.severity_justification|markdown_render|default_if_none:"" }}

References

{{ finding.get_references_with_links|markdown_render|default_if_none:"" }}
{% include "dojo/snippets/sonarqube_history.html" with finding=finding only %} {% include "dojo/snippets/comments.html" with notes=notes object=finding destination="finding" %}
ProTip! Type e to edit any finding, p and n to navigate to the previous or next finding, v to verify, and c to close the finding.
{% endblock %} {% block postscript %} {{ block.super }} {% include "dojo/filter_js_snippet.html" %} {% endblock %}