Cyver offers the possibility of importing findings using a xml file. In order to make a successful import, the provided xml file needs to follow a specific format.
These are the rules for the columns to be met on the provided xml file:
| Field | Values | Example |
| Code | default: auto-generated |
<Code>F-2023-3840</Code> |
| CWEList | for example: CWE-1; CWE-721 |
<CWEList> |
| CVEList | for example: CVE-1; CVE-721 |
<CVEList> |
| Controls | <Controls> <Control> <Code>A01:2017</Code> <ControlGroup> <Code>A01:2017</Code> <ComplianceNorm> <Code/> </ComplianceNorm> </ControlGroup> </Control> </Controls> |
|
| Title (required field) | <Title>.NET Deserialization Remote Code Execution</Title> | |
| Type | Vulnerability Noncomformity Observation default: Vulnerability |
<Type>Vulnerability</Type> |
| Description | <Description>Description Text String</Description> | |
| External References |
<ExternalReferences> <ExternalUrl> </ExternalReferences> |
|
| BackgroundInformation | <BackgroundInformation>Background Information Text String</BackgroundInformation> | |
| Impact | 0 1 2 3 4 5 default: 0 |
<Impact>1</Impact> |
| ImpactDescription | <ImpactDescription>Impact Description Text String</ImpactDescription> | |
| Likelihood | 0 1 2 3 4 5 default: 0 |
<Likelihood>1</Likelihood> |
| LikelihoodDescription | <LikelihoodDescription>Likelihood Description Text String</LikelihoodDescription> | |
| Severity | Info Low Medium High Critical default: Info |
<Severity>Low</Severity> |
| Recommendation | <Recommendation>Recommendation Text String</Recommendation> | |
| CVSS40Score | <CVSS40Score xmlns:p3="http://www.w3.org/2001/XMLSchema-instance" p3:nil="true"/> | |
| CVSS31Vector | <CVSS31Vector>CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L</CVSS31Vector> | |
| CVSS31Score | <CVSS31Score>2.7</CVSS31Score> | |
| CVSS30Score | <CVSS30Score xmlns:p3="http://www.w3.org/2001/XMLSchema-instance" p3:nil="true"/> | |
| CVSS20Score | <CVSS20Score xmlns:p3="http://www.w3.org/2001/XMLSchema-instance" p3:nil="true"/> | |
| Status | Draft PendingFix Fixed ReadyRetest Accepted ToReview Reviewed default: Draft |
<Status>PendingFix</Status> |
| Occurrence | <Occurrence>New</Occurrence> | |
| Assets | <Assets> <Asset> <Domain/> <Title>10.211.55.3</Title> <Ip>10.211.55.3</Ip> <Type>Other</Type> </Asset> </Assets> |
|
| Evidences | <Evidences> <Evidence> <Title>Evidence Title</Title> <Location>Evidence Location</Location> <Version>Evidence Version</Version> <Reproduce>Evidence Reproduce</Reproduce> <Results>Evidence Results</Results> <IssueDetails>Issue Details</IssueDetails> </Evidence> </Evidences> |
|
| Labels |
<Labels> |
|
|
VulnerabilityTypes |
DoS CodeExecution Overflow MemoryCorruption SqlInjection XSS DirectoryTraversal HttpResponseSplitting BypassSomething GainInformation GainPrivileges CSRF FileInclusion |
< VulnerabilityTypes > <Code>CodeExecution</Code> </VulnerabilityTypes> |
Fields like Days Open, Assignee, Closed on, Review on, Published on, Visible to client display only when exporting Findings.