{% extends "base.html" %} {% load display_tags %} {% load authorization_tags %} {% load humanize %} {% load static %} {% load i18n %} {% load get_endpoint_status %} {% block add_styles %} {{ block.super }} .tooltip-inner { max-width: 650px; } {% endblock %} {% block add_css_before %} {{ block.super }} {% endblock %} {% block content %} {{ block.super }} {% user_can_clear_peer_review finding dojo_user as clear_peer_review %}

{{ finding.title }} {% include "dojo/snippets/tags.html" with tags=finding.tags.all %} {% if finding.last_reviewed %} Last Reviewed {{ finding.last_reviewed | naturalday }} by {{ finding.last_reviewed_by }}, {% else %} Last Reviewed {{ finding.date | naturalday }} by {{ finding.reporter }}, {% endif %} {% if finding.last_status_update %} Last Status Update {{ finding.last_status_update | naturalday }}, {% endif %} Created {% if finding.last_reviewed > finding.created %} {{ finding.created | naturalday }} {% else %} {{ finding.date | naturalday }} {% endif %} {% if latest_test_import_finding_action %} , Last Mentioned in (Re)Import: {{ latest_test_import_finding_action.created | naturalday }} as {{ latest_test_import_finding_action.get_action_display }} {% endif %}

{% if finding.under_review %} {% endif %} {% if finding.under_defect_review %} {% endif %} {% block header_head %} {% if system_settings.enable_finding_sla %} {% endif %} {% if finding.scanner_confidence %} {% endif %} {% if finding.risk_acceptance_set.all %} {% endif %} {% if finding.duplicate_finding %} {% endif %} {% if duplicate_cluster and not finding.duplicate %} {% elif duplicate_cluster and finding.duplicate %} {% endif %} {% if finding.publish_date %} {% endif %} {% if finding.planned_remediation_date %} {% endif%} {% if finding.planned_remediation_version %} {% endif %} {% if finding.mitigated %} {% endif %} {% if finding.vuln_id_from_tool %} {% endif %} {% endblock header_head %} {% block header_body %} {% if system_settings.enable_finding_sla %} {% endif %} {% if finding.scanner_confidence %} {% endif %} {% if finding.risk_acceptance_set.all %} {% endif %} {% if finding.duplicate_finding %} {% endif %} {% if duplicate_cluster %} {% endif %} {% if finding.publish_date %} {% endif %} {% if finding.planned_remediation_date %} {% endif %} {% if finding.planned_remediation_version %} {% endif %} {% if finding.mitigated %} {% endif %} {% endwith %} {% if finding.vuln_id_from_tool %} {% endif %} {% endblock header_body %}
Alert: This Finding is under review and may not be 100% accurate. {% if finding|has_object_permission:"Finding_Edit" and clear_peer_review %} [Clear Review] {% endif %}
Alert: Please review this finding to verify if the defect is remediated. [Review Finding for Closure]
ID SeveritySLAScanner ConfidenceStatusRisk AcceptanceOriginalDuplicatesDuplicate ClusterType Date discovered AgeVuln Publish datePlanned Remediation{% trans "Planned Remediation version" %}ReporterDate Mitigated Mitigated ByCWE Vulnerability Id Found byVuln ID from tool
{{ finding.id }} {% if finding.severity %} {% if finding.cvssv3 %} {% endif %} {{ finding.severity_display }} {% if finding.cvssv3_score %} ({{ finding.cvssv3_score }}) {% endif %} {% if finding.cvssv3 %} {% endif %} {% else %} Unknown {% endif %} {{ finding|finding_sla }} {{finding.get_scanner_confidence_text}} {% comment %} {% if finding.duplicate %} {% include "dojo/finding_related_actions.html" with similar_finding=finding finding_context=finding intro=finding|finding_display_status|safe %} {% else %} {{ finding|finding_display_status|safe }} {% endif %} {% endcomment %} {{ finding|finding_display_status|safe }}  {{ finding|import_history }} {% for ra in finding.risk_acceptance_set.all|slice:":5" %} {% endfor %}
{% if finding.static_finding and finding.dynamic_finding > 0 %} Static/Dynamic {% elif finding.static_finding > 0 %} Static {% else %} Dynamic {% endif %} {{ finding.date }} {{ finding.age }} days{{ finding.publish_date }}{{ finding.planned_remediation_date }}{{ finding.planned_remediation_version }}{{ finding.reporter }}{{ finding.mitigated }} {{ finding.mitigated_by }} {% if finding.cwe > 0 %} {{ finding.cwe }} {% endif %} {% with finding|first_vulnerability_id as first_vulnerability_id %} {% if first_vulnerability_id %} {% if first_vulnerability_id|has_vulnerability_url %} {{ first_vulnerability_id }} {% else %} {{ first_vulnerability_id }} {% endif %} {% endif %} {% if found_by %} {% for scanner in found_by %} {{ scanner }} {% endfor %} {% else %} {{ finding.test.test_type }} {% endif %} {{ finding.vuln_id_from_tool }}
{% with finding|additional_vulnerability_ids as additional_vulnerability_ids %} {% if additional_vulnerability_ids %}
Additional Vulnerability Ids
{% for vulnerability_id in additional_vulnerability_ids %} {% if vulnerability_id|has_vulnerability_url%} {{ vulnerability_id }} {% else %} {{ vulnerability_id }} {% endif %} {% if not forloop.last %}, {% endif %} {% endfor %}
{% endif %} {% endwith %} {% if finding.static_finding or finding.line > 0 %} {% if finding.sast_source_object or finding.sast_sink_object or finding.sast_source_file_path or finding.sast_source_line > 0 %} {# For tools that give information on both source (start) and sink (end) of the attack vector #}
Source Filepath Source Line Number Source Object
{{ finding.get_sast_source_file_path_with_link|safe }} {{ finding.sast_source_line }} {{ finding.sast_source_object }}
Sink Filepath Sink Line Number Sink Object
{{ finding.get_file_path_with_link|safe }} {{ finding.line }} {{ finding.sast_sink_object }}
{% endif %} {% endif %} {% if finding.service or finding.file_path or finding.line > 0 or finding.has_jira_configured or finding.has_jira_issue or finding.github_issue or finding.github_conf_new or finding.finding_group or finding.component_name or finding.nb_occurences > 1 %}
{% if finding.service %} {% endif %} {% if finding.file_path %} {% endif %} {% if finding.line %} {% endif %} {% if finding.nb_occurences > 1 %} {% endif %} {% if finding.component_name %} {% endif %} {% if finding.component_version %} {% endif %} {% if finding.has_jira_configured or finding.jira_issue %} {% endif %} {% if finding.github_conf_new or finding.github_issue %} {% endif %} {% if 'is_finding_groups_enabled'|system_setting_enabled and finding.finding_group %} {% endif %} {% if finding.effort_for_fixing %} {% endif %} {% if finding.service %} {% endif %} {% if finding.file_path %} {% endif %} {% if finding.line %} {% endif %} {% if finding.nb_occurences > 1 %} {% endif %} {% if finding.component_name %} {% endif %} {% if finding.component_version %} {% endif %} {% if finding.has_jira_configured or finding.has_jira_issue or finding.has_jira_group_issue %} {% endif %} {% if finding.github_conf_new or finding.github_issue %} {% endif %} {% if 'is_finding_groups_enabled'|system_setting_enabled and finding.finding_group %} {% endif %} {% if finding.effort_for_fixing %} {% endif %}
ServiceLocationLine NumberNb occurencesComponent NameComponent VersionJIRA JIRA ChangeGitHubGroup{% trans "Effort for fixing" %}
{{ finding.service }} {{ finding.get_file_path_with_link|safe }} {{ finding.line }} {{ finding.nb_occurences }} {{ finding.component_name }} {{ finding.component_version }} {% if finding.has_jira_group_issue %} {{ finding.finding_group | jira_key }} {% endif %} {% if finding.has_jira_issue %} {{ finding | jira_key }} {% else %} {% if can_be_pushed_to_jira %} {% if not finding.has_jira_group_issue %} None {% comment %} {% endcomment %} {% endif %} {% else %} {% endif %} {% endif %} {% if finding.has_jira_group_issue %}
{{ finding.finding_group.jira_issue.jira_change|naturalday }}
{% elif finding.jira_issue %}
{{ finding.jira_issue.jira_change|naturalday }}
{% endif %}
{% if finding.github_issue %} #{{ finding.github_issue.issue_id }} {% endif %} {{ finding.finding_group.name }} {{ finding.effort_for_fixing }}
{% endif %} {% if finding.param or finding.payload %}
{% if finding.payload %} {% endif %} {% if finding.payload %} {% endif %}
Injected Parameter(s)Payload
{{ finding.param|default_if_none:"" }} {{ finding.payload|default_if_none:"" }}
{% endif %} {% if finding.duplicate_finding_set %} {% comment %} little extra div to serve as anchor, with some padding and padding cancelling margin to make sure it scrolls into view correctly {% endcomment %}

Duplicate Cluster ({{ finding|finding_duplicate_cluster_size }})

{% if finding.duplicate_finding %} {% include "dojo/finding_related_list.html" with finding_context=finding finding_first_related=finding.duplicate_finding finding_list=duplicate_cluster prefix='duplicate' %} {% else %} {% include "dojo/finding_related_list.html" with finding_context=finding finding_first_related=finding finding_list=duplicate_cluster prefix='duplicate' %} {% endif %}
{% endif %}

Similar Findings ({{ similar_findings.paginator.count }})  

{% url 'view_finding' finding.id as finding_url %} {% include "dojo/filter_snippet.html" with form=similar_findings_filter.form form_id="similar" clear_js=True restart_link=finding_url %}
{% if similar_findings_filter %}
{% include "dojo/finding_related_list.html" with finding_context=finding finding_list=similar_findings prefix='similar' %}
{% endif %}
{% comment %} Add a form to (ab)use to submit any actions related to similar/duplicates as POST requests {% endcomment %} {% if 'TRACK_IMPORT_HISTORY'|setting_enabled and latest_test_import_finding_action %}

{% trans "Import History" %} ({{ test_import_finding_actions_count }})

{% include "dojo/filter_snippet.html" with form=test_import_filter.form %} {% include "dojo/filter_snippet.html" with form=test_import_finding_action_filter.form %}
{% if paged_test_import_finding_actions %} {% for test_import_finding_action in paged_test_import_finding_actions %} {% endfor %}
{% trans "Action" %} {% trans "Date/Time" %} {% trans "Import Type" %} {% trans "Branch/Tag" %} {% trans "Build ID" %} {% trans "Commit" %} {% trans "Version" %} {% trans "Endpoint" %}
{{ test_import_finding_action.get_action_display }} {{ test_import_finding_action.test_import.created|date:"DATETIME_FORMAT" }} {{ test_import_finding_action.test_import|import_settings_tag }} {{ test_import_finding_action.test_import.type }} {{ test_import_finding_action.test_import.branch_tag|default_if_none:"" }} {{ test_import_finding_action.test_import.build_id|default_if_none:"" }} {{ test_import_finding_action.test_import.commit_hash|default_if_none:"" }} {{ test_import_finding_action.test_import.version|default_if_none:"" }} {{ test_import_finding_action.test_import.import_settings.endpoint|default_if_none:"" }}
{% else %}

{% trans "No import history found." %}

{% endif %}
{% include "dojo/paging_snippet.html" with page=paged_test_import_finding_actions prefix='test_import_finding_actions' page_size=True %}
{% endif %} {% include "dojo/snippets/endpoints.html" with finding=finding destination="UI" %}

Description

{{ finding.description|markdown_render|default_if_none:"" }}
{% if files %}

Files

{% for file in files %}
{% url 'access_file' fid=file.id oid=finding.id obj_type='Finding' as image_url %} {% if file|get_thumbnail %} thumbnail {% else %} {% endif %}
{{ file.title }}
{% endfor %}
{% endif %}

Mitigation

{{ finding.mitigation|markdown_render|default_if_none:"" }}
{% if finding.burprawrequestresponse_set.all %}

Request / Response Pairs

{% for req_resp in finding.burprawrequestresponse_set.all %}

Request #{{ forloop.counter }}

{{ req_resp.get_request }}

Response #{{ forloop.counter }}

{{ req_resp.get_response }}
{% endfor %}
{% endif %}

Impact

{{ finding.impact|markdown_render|default_if_none:"" }}

Steps To Reproduce

{{ finding.steps_to_reproduce|markdown_render|default_if_none:"" }}

Severity Justification

{{ finding.severity_justification|markdown_render|default_if_none:"" }}

References

{{ finding.get_references_with_links|markdown_render|default_if_none:"" }}
{% if finding.static_finding != True and system_settings.enable_credentials %}

Credential {% if not cred_finding and finding|has_object_permission:"Finding_Edit" %} {% if cred_engagement or creds %} {% endif %} {% endif %}

{% if cred_finding or creds %} {% if cred_finding %} {% for cred in cred_finding %} {% endfor %} {% endif %} {% if not cred_finding %} {% for cred in creds %} {% endfor %} {% endif %}
Name Username Role Environment Authentication Provider Login Valid Actions
Credential Configured for this Finding {% if not cred_finding %}
None configured
{% endif %}
{{ cred.cred_id.name }} {{ cred.cred_id.username }} {{ cred.cred_id.role }} {{ cred.cred_id.environment }} {{ cred.is_authn_provider }} {{ cred.cred_id.is_valid }}
{% if user.is_superuser %} View {% endif %} {% if finding|has_object_permission:"Finding_Edit" %} Delete {% endif %}
Credentials Inherited from Test: {{ finding.test }}
{{ cred.cred_id.name }} {{ cred.cred_id.username }} {{ cred.cred_id.role }} {{ cred.cred_id.environment }} {{ cred.is_authn_provider }} {{ cred.cred_id.is_valid }}
{% else %}

No credentials configured. {% if not cred_engagement %} Configure engagement credentials first, then add a credential to the test or finding. {% endif %}

{% endif %}
{% endif %}
{% include "dojo/snippets/sonarqube_history.html" with finding=finding only %} {% include "dojo/snippets/comments.html" with notes=notes object=finding destination="finding" %}
ProTip! Type e to edit any finding, p and n to navigate to the previous or next finding.
{% endblock %} {% block postscript %} {{ block.super }} {% include "dojo/filter_js_snippet.html" %} {% endblock %}