Use this REST API to retrieve vulnerability details.
openapi: 3.0.1
info:
title: Sonatype Lifecycle Public REST Advanced Search Vulnerability Details API
version: 1.201.0-02
description: Use the Advanced Search REST API to perform searches on Lifecycle application scan reports.
security:
- BasicAuth: []
BearerAuth: []
tags:
- description: Use this REST API to retrieve vulnerability details.
name: Vulnerability Details
paths:
/api/v2/vulnerabilities:
post:
description: 'Use this method to retrieve bulk details for vulnerabilies using authenticated or non-authenticated requests. A non-authenticated request will retrieve limited details for the vulnerability.
Permissions required: View IQ Elements'
operationId: getSecurityVulnerabilityDetails
requestBody:
content:
application/json:
schema:
items:
type: string
type: array
description: Enter the vulnerability identifiers (CVE ID or Sonatype Vulnerability Identifier) as query parameter
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/BulkSecurityVulnerabilityDataDTO'
description: The response contains a list of vulnerability details corresponding to the vulnerabilitity or component identifiers.<ul><li>`vulnIds` is a list of related vulnerability identifiers.</li><li>`vulnerabilityLink` is the link to the CVE or Sonatype Vulnerability Identifier description page.</li><li>`source` indicates the source from where the vulnerability details are obtained from.</li><li>`mainSeverity` is the official severity scores and vector strings assigned to the vulnerability.</li><li>`severityScores` are all other known severity scores not mentioned in the `mainSeverity`.</li><li>`weakness` indicates the source of the CWE, CWEId and the URI for the description of the CWE.</li><li>`categories` indicates the categories of the vulnerabilities.</li><li>`description` is the detailed description of the vulnerability. </li><li>`explanationMarkdown` is the text in markdown format for the explanation of the vulnerability.</li><li>`componentExplanationMarkdown` is the text in markdown format that is used to populate the vulnerability details in the UI.</li><li>`recommendationMarkdown` is the text in markdown format for a non-vulnerable component recommendationin the the UI.</li><li>`componentRecommendationMarkdown` is the text in markdown format for the recommended component.</li><li>`rootCauses`indicates the paths where the vulnerability is located, as well as the impacted version ranges of the vulnerable component.</li><li>`advisories`is a list of links to the published advisories.</li><li>`vulnerableVersionRanges` contains a list of the component version ranges that are vulnerable. Version ranges can be inclusive, denoted by square brackets [ ] or exclusive, denoted by ( )</li><li>`researchType` indicates if the vulnerability details were researched on FAST TRACK or DEEP DIVE basis<li>`isAdvancedVulnerabilityDetection` indicates if this vulnerability has been detected in entire files and embedded dependencies, typically beyond the pubic feeds, using our proprietary detection systems.</li><li>`customData` field contains the vulnerability attributes that are customized by the users, if found under the requested scope</li> <li>`detectionType` indicates the type of vulnerability detection system used to obtain the vulnerability data. Possible values are PRIMARY, SECONDARY, AST, UNSHADER, OTHER or null. <ul><li>PRIMARY means the vulnerability data has been investigated by the security researcher to explicitly implicate components referenced in the feed or is a result of independent research.</li> <li>SECONDARY means the component has been implicated by our automated systems because it shares vulnerable code with components that were implicated by the PRIMARY systems.</li><li>AST means that the vulnerability is discovered as part of Application Security Testing and includes common issues such as code injection, authentication flaws and data leakage.</li><li>UNSHADER means the vulnerability is discovered by the Shaded Vulnerability Algorithm.</li> </ul></li></ul>
security: []
tags:
- Vulnerability Details
/api/v2/vulnerabilities/{refId}:
get:
description: 'Use this method to retrieve details for a vulnerability using authenticated or non-authenticated requests. A non-authenticated request will retrieve limited details for the vulnerability.
Permissions required: View IQ Elements'
operationId: getSecurityVulnerabilityDetails_1
parameters:
- description: Enter the vulnerability identifier (CVE ID or Sonatype Vulnerability Identifier)
in: path
name: refId
required: true
schema:
type: string
- description: Enter the component identifier.
in: query
name: componentIdentifier
schema:
$ref: '#/components/schemas/ComponentIdentifier'
- description: Enter the name of the component identification source (third-party) for this vulnerability. The response will retrieve vulnerability data from this third-party data source.
in: query
name: identificationSource
schema:
type: string
- description: Enter the scanId where the vulnerability was detected. The response will retrieve vulnerability data from the third-party data source and not HDS.
in: query
name: scanId
schema:
type: string
- description: Enter the value for ownerType where this vulnerability was detected. The response will retrieve the vulnerability data from the third-party data source and not HDS.
in: query
name: ownerType
schema:
enum:
- application
- organization
- repository_container
- repository_manager
- repository
- global
type: string
- description: Enter the ownerId where this vulnerability was detected. The response will retrieve data from the third-party data source and not HDS.
in: query
name: ownerId
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/SecurityVulnerabilityDataDTO'
description: The response contains vulnerability details corresponding to the vulnerability or component identifier.<ul><li>`vulnIds` is a list of related vulnerability identifiers.</li><li>`vulnerabilityLink` is the link to the CVE or Sonatype Vulnerability Identifier description page.</li><li>`source` indicates the source from where the vulnerability details are obtained from.</li><li>`mainSeverity` is the official severity scores and vector strings assigned to the vulnerability.</li><li>`severityScores` are all other known severity scores not mentioned in the `mainSeverity`.</li><li>`weakness` indicates the source of the CWE, CWEId and the URI for the description of the CWE.</li><li>`categories` indicates the categories of the vulnerabilities.</li><li>`description` is the detailed description of the vulnerability. </li><li>`explanationMarkdown` is the text in markdown format for the explanation of the vulnerability.</li><li>`componentExplanationMarkdown` is the text in markdown format that is used to populate the vulnerability details in the UI.</li><li>`recommendationMarkdown` is the text in markdown format for a non-vulnerable component recommendationin the the UI.</li><li>`componentRecommendationMarkdown` is the text in markdown format for the recommended component.</li><li>`rootCauses`indicates the paths where the vulnerability is located, as well as the impacted version ranges of the vulnerable component.</li><li>`advisories`is a list of links to the published advisories.</li><li>`vulnerableVersionRanges` contains a list of the component version ranges that are vulnerable. Version ranges can be inclusive, denoted by square brackets [ ] or exclusive, denoted by ( )</li><li>`researchType` indicates if the vulnerability details were researched on FAST TRACK or DEEP DIVE basis<li>`isAdvancedVulnerabilityDetection` indicates if this vulnerability has been detected in entire files and embedded dependencies, typically beyond the pubic feeds, using our proprietary detection systems.</li><li>`customData` field contains the vulnerability attributes that are customized by the users, if found under the requested scope</li> <li>`detectionType` indicates the type of vulnerability detection system used to obtain the vulnerability data. Possible values are PRIMARY, SECONDARY, AST, UNSHADER, OTHER or null. <ul><li>PRIMARY means the vulnerability data has been investigated by the security researcher to explicitly implicate components referenced in the feed or is a result of independent research.</li> <li>SECONDARY means the component has been implicated by our automated systems because it shares vulnerable code with components that were implicated by the PRIMARY systems.</li><li>AST means that the vulnerability is discovered as part of Application Security Testing and includes common issues such as code injection, authentication flaws and data leakage.</li><li>UNSHADER means the vulnerability is discovered by the Shaded Vulnerability Algorithm.</li> </ul></li></ul>
security: []
tags:
- Vulnerability Details
components:
schemas:
SecurityVulnerabilityWeakness:
properties:
cweIds:
items:
$ref: '#/components/schemas/CweId'
type: array
cweSource:
type: string
type: object
RootCauseDTO:
properties:
listOfPaths:
items:
type: string
type: array
versionRange:
type: string
type: object
SecurityVulnerabilityData:
properties:
advisories:
items:
$ref: '#/components/schemas/ReferenceLink'
type: array
categories:
items:
type: string
type: array
componentDetectionMarkdown:
type: string
componentExplanationMarkdown:
type: string
componentRecommendationMarkdown:
type: string
customData:
$ref: '#/components/schemas/SecurityVulnerabilityCustomData'
description:
type: string
detectionMarkdown:
type: string
detectionType:
type: string
epssData:
$ref: '#/components/schemas/EpssData'
explanationMarkdown:
type: string
identificationSource:
type: string
identifier:
type: string
isAdvancedVulnerabilityDetection:
type: boolean
kevData:
$ref: '#/components/schemas/KevData'
mainSeverity:
$ref: '#/components/schemas/SecurityVulnerabilitySeverity'
recommendationMarkdown:
type: string
researchType:
enum:
- FAST_TRACK
- DEEP_DIVE
- PUBLIC_RESEARCH
- VENDOR_RESEARCH
type: string
rootCauses:
items:
$ref: '#/components/schemas/RootCause'
type: array
severityScores:
items:
$ref: '#/components/schemas/SecurityVulnerabilitySeverity'
type: array
source:
$ref: '#/components/schemas/VulnerabilitySource'
vulnIds:
items:
type: string
type: array
vulnerabilityLink:
format: uri
type: string
vulnerableVersionRanges:
items:
type: string
type: array
weakness:
$ref: '#/components/schemas/SecurityVulnerabilityWeakness'
type: object
SecurityVulnerabilityWeaknessDTO:
properties:
cweIds:
items:
$ref: '#/components/schemas/CweIdDTO'
type: array
cweSource:
type: string
type: object
SecurityVulnerabilityCustomData:
properties:
cvssSeverity:
format: float
type: number
cvssVector:
type: string
cweId:
type: string
remediation:
type: string
type: object
SecurityVulnerabilityCustomDataDTO:
properties:
cvssSeverity:
format: float
type: number
cvssVector:
type: string
cweId:
type: string
remediation:
type: string
type: object
VulnerabilitySourceDTO:
properties:
longName:
type: string
shortName:
type: string
type: object
EpssData:
properties:
currentScore:
format: double
type: number
VulnerabilitySource:
properties:
longName:
type: string
shortName:
type: string
type: object
RootCause:
properties:
listOfPaths:
items:
type: string
type: array
versionRange:
type: string
type: object
ComponentIdentifier:
properties:
coordinates:
additionalProperties:
type: string
type: object
format:
type: string
type: object
CweIdDTO:
properties:
id:
type: string
uri:
format: uri
type: string
type: object
KevData:
properties:
isKev:
type: boolean
type: object
SecurityVulnerabilityDataDTO:
properties:
advisories:
items:
$ref: '#/components/schemas/ReferenceLinkDTO'
type: array
categories:
items:
type: string
type: array
componentDetectionMarkdown:
type: string
componentExplanationMarkdown:
type: string
componentRecommendationMarkdown:
type: string
customData:
$ref: '#/components/schemas/SecurityVulnerabilityCustomDataDTO'
description:
type: string
detectionMarkdown:
type: string
detectionType:
type: string
epssData:
$ref: '#/components/schemas/EpssData'
explanationMarkdown:
type: string
identificationSource:
type: string
identifier:
type: string
isAdvancedVulnerabilityDetection:
type: boolean
kevData:
$ref: '#/components/schemas/KevData'
mainSeverity:
$ref: '#/components/schemas/SecurityVulnerabilitySeverityDTO'
recommendationMarkdown:
type: string
researchType:
enum:
- FAST_TRACK
- DEEP_DIVE
- PUBLIC_RESEARCH
- VENDOR_RESEARCH
type: string
rootCauses:
items:
$ref: '#/components/schemas/RootCauseDTO'
type: array
severityScores:
items:
$ref: '#/components/schemas/SecurityVulnerabilitySeverityDTO'
type: array
source:
$ref: '#/components/schemas/VulnerabilitySourceDTO'
vulnIds:
items:
type: string
type: array
vulnerabilityLink:
format: uri
type: string
vulnerableVersionRanges:
items:
type: string
type: array
weakness:
$ref: '#/components/schemas/SecurityVulnerabilityWeaknessDTO'
type: object
BulkSecurityVulnerabilityDataDTO:
properties:
vulnerabilities:
additionalProperties:
$ref: '#/components/schemas/SecurityVulnerabilityData'
type: object
type: object
SecurityVulnerabilitySeverityDTO:
properties:
score:
format: float
type: number
source:
type: string
sourceLabel:
type: string
vector:
type: string
type: object
ReferenceLink:
properties:
referenceType:
type: string
url:
type: string
type: object
SecurityVulnerabilitySeverity:
properties:
score:
format: float
type: number
source:
type: string
sourceLabel:
type: string
vector:
type: string
type: object
ReferenceLinkDTO:
properties:
referenceType:
type: string
url:
type: string
type: object
CweId:
properties:
id:
type: string
uri:
format: uri
type: string
type: object
securitySchemes:
BasicAuth:
scheme: basic
type: http
BearerAuth:
bearerFormat: JWT
scheme: bearer
type: http