Working with Vulnerabilities
In the Project View, click the Vulnerabilities tab to display the list of vulnerabilities, which contains the information listed in the table below.
Checkmarx includes predefined presets with IAST, which work with all languages supported by IAST such as the following:
PCI DSS V3.2 (v3.9.0 and up)
OWASP Top 10 for 2017
OWASP Top 10 for 2013
OWASP Top 10 for 2010
OWASP REST API Top 10 (v3.7.0 and up)
A list of predefined presets and subcategories is available in the next section of this page. To filter the scan results with a predefined preset, do the following:
Next to Add Filters, select the predefined preset from the drop-down list.
From the Preset Severity drop-down menu, select the vulnerability severity that you want to display in the scan results. By default, All is selected for a predefined preset, but any available severity can be selected instead.
To return to the regular IAST scan results without applying a predefined preset, click Clear at the top of the dropdown menu.
Clicking Vulnerability Description in the list of vulnerabilities opens the vulnerability description that displays comprehensive information about the selected vulnerability. This is useful for defining how to handle the vulnerability as illustrated in the screen images below for the example of SQL Injection.
The vulnerability description displays information that includes the vulnerability risk and cause details and general recommendations for remediating and avoiding the vulnerability. Source code examples and CWE links are also provided.
Modifying the vulnerability state may be useful for disregarding false positives or just for defining, what vulnerabilities to handle, and how to handle them.
Note
Only users with the correct permissions can change the state of a vulnerability and approve a suggested vulnerability state change.
Changing the State of a Vulnerability or Suggesting a Vulnerability State Change can only be performed on completed scans.
To change the state of a vulnerability:
Check the respective vulnerability.
Click Change State. The Select State dialog is displayed with the states that can be defined.
Select the desired state and click <CHANGE>. The state of the vulnerability is changed and displayed in the Vulnerabilities List and under Vulnerability Status.
State | Description |
|---|---|
To Verify (default) | Vulnerability requires verification |
Confirmed | Vulnerability confirmed as vulnerable and requires handling |
Suspicious | Vulnerability proposed as suspicious (potential FP). |
Not a Problem | Vulnerability confirmed as not vulnerable (confirmed FP). |
Remediated | Vulnerability has been confirmed as handled. |
To suggest a vulnerability state change:
Select the desired state and click <SUGGEST>. The change is now waiting for approval and displayed in the Vulnerabilities List. In the example below, the suspicious state has been suggested and is waiting for approval.
Note
The actual state of the vulnerability does not change until it is approved.
No special permissions are required to suggest changing the vulnerability state.
To approve a suggested vulnerability state change:
Check the vulnerability for which a change has been suggested. The Review State dialog appears.
Do one of the following:
To approve, click <APPROVE>. The state of the vulnerability is changed to the suggested state displayed in the Vulnerabilities List and the Vulnerability Status.
To deny, click <DENY>. The suggestion is overruled and the state of the vulnerability remains as it was before the suggestion.
Severity changes are useful for defining, what vulnerabilities to handle, and how to handle them. In cases where there is no agreement on the severity of a specific finding, or a final decision has been made, the severity can be changed as follows:
Check the severity of that vulnerability in the list of vulnerabilities. The Change Severity dialog appears.
Select the severity and click <CHANGE>. The severity of the vulnerability is changed. The new severity appears in the Vulnerabilities List and the Vulnerability Status.
Note
Changing the Severity of a Vulnerability can only be performed on completed scans.
Severity change actions are logged automatically in the Comments list as [Auto Comment].
Comments are useful for defining, what vulnerabilities to handle, and how to handle them. In addition, auto comments are used to log any actions performed on the vulnerability, for example changing its severity.
To add a comment to a vulnerability:
Check the relevant severity in the list of vulnerabilities. The Add Comment dialog appears.
Enter the desired comment (max. 256 characters) and click <ADD>. The comment is saved in the list of comments for the selected vulnerability.
To view the list of all comments:
In the Projects View, under Vulnerabilities, click Comment for the desired vulnerability. All existing comments for this vulnerability appear listed.
The following actions are automatically logged in the Comments list as [Auto Comment]:
Change State
Review State (Deny/Approve)
Change Severity
Assign to User.
Note
Only users with the proper permissions can add a comment to a vulnerability.
Comments can only be added to vulnerabilities detected by completed scans.
Check the relevant severity in the list of vulnerabilities.
Click Assign to User. The Select User dialog appears.
Select the desired user from the list and click <ASSIGN>. The vulnerability is assigned to the user and the change appears in the Vulnerabilities List and the Vulnerability Status.
Assigning a vulnerability to a user is are automatically logged in the Comments list as [Auto Comment].
Note
Only users with the proper permissions can assign a vulnerability to a user.
Vulnerabilities can only be assigned to users, if the scan is complete.