Discrepancy in Severity Mappings for Veracode SCA scans

[cah-thomas-howard]

Veracode SCA scans given the following severities based upon CVSS scores:

However, DefectDojo tags the severity using this criteria:

Given this, a CVSS score of 4.0 will put the severity at 'Medium' in DD but the description assigned to the finding will show CVS Score 4.0 (Low) since the severity value coming from Veracode is used within the description:

Personally, I would think the CVSS breakdown within Veracode would be used since it's well defined, with Very High mapping to Critical and Low/Very Low mapping to Low.

Veracode SCA Severity mapping
https://docs.veracode.com/r/review_severity_exploitability

DefectDOJO Veracode parser SCA Severity Mapping

django-DefectDojo/dojo/tools/veracode/parser.py

Line 192 in 612a0f6

def __cvss_to_severity(cls, cvss):

Deployment method (select with an X)

• Docker Compose

• Kubernetes

• GoDojo

• DefectDojo version 2.7.1

[damiencarol]

Personally, I would think the CVSS breakdown within Veracode would be used since it's well defined, with Very High mapping to Critical and Low/Very Low mapping to Low.

I agree. I think we can improve that. Will try to create a patch for that.

[coheigea]

Perhaps it would be a good idea to make it configurable rather than hard-coding it, because existing users will be impacted by any change to the severity mapping

[coheigea]

@damiencarol I think the problem in the Veracode parser is that it's manually mapping CVSS scores to DefectDojo severity. However, the Veracode XML actually contains the severity score. So we should set the DefectDojo severity according to:

• 5 -> Critical
• 4 -> High
• 3 -> Medium
• 2 -> Low
• 1 and 0 -> Info

WDYT? I can prepare a patch if you agree.

[coheigea]

This issue can be closed