VCIO-next: Design and Add API for AdvisoryV2 Models #1882

Activity

1. TG1999

   changed the title [-]VCIO-next: Add API for AdvisoryV2 Models[/-] [+]VCIO-next: Design and Add API for AdvisoryV2 Models[/+] on May 23, 2025
2. TG1999

   added this to 04-VulnerableCode nexton Jul 11, 2025
3. pombredanne

   assigned

   TG1999

   on Jul 15, 2025
4. pombredanne

   added a parent issue on Jul 15, 2025

   • VCIO-next: Improve advisories model and update pipelines #1944
5. TG1999 commented on Jul 15, 2025

   

   TG1999

   on Jul 15, 2025

   ContributorAuthor

   More actions

   This is done now!

   PRs for references:
   #1866

   To test this:
   Set up Vulnerablecode on your system locally and run a new V2 importer pipeline for example:

   ./manage.py import nodejs_security_wg

   Then do make run and go to VCIO app, navigate to api/v2/advisories-packages?purl=pkg:npm/zwserver@0.1.0

   `This will be the API response with the new advisory Design

   {
       "count": 1,
       "next": null,
       "previous": null,
       "results": {
           "advisories": {
               "gitlab_importer_v2/npm/zwserver/CVE-2017-16149": {
                   "advisory_id": "gitlab_importer_v2/npm/zwserver/CVE-2017-16149",
                   "url": "https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/zwserver/CVE-2017-16149.yml",
                   "aliases": [],
                   "summary": "Path Traversal\nzwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing `../` in the url.",
                   "severities": [],
                   "weaknesses": [
                       {
                           "cwe_id": "22",
                           "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                           "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."
                       },
                       {
                           "cwe_id": "1035",
                           "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
                           "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
                       },
                       {
                           "cwe_id": "937",
                           "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
                           "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
                       }
                   ],
                   "references": [
                       {
                           "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16149",
                           "reference_type": "",
                           "reference_id": "CVE-2017-16149"
                       }
                   ],
                   "exploitability": "0.5",
                   "weighted_severity": "0.0",
                   "risk_score": null
               },
               "gitlab_importer_v2/npm/zwserver/GMS-2017-235": {
                   "advisory_id": "gitlab_importer_v2/npm/zwserver/GMS-2017-235",
                   "url": "https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/zwserver/GMS-2017-235.yml",
                   "aliases": [],
                   "summary": "Directory Traversal\n`zwserver` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url./n",
                   "severities": [],
                   "weaknesses": [
                       {
                           "cwe_id": "1035",
                           "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
                           "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
                       },
                       {
                           "cwe_id": "937",
                           "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
                           "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
                       }
                   ],
                   "references": [
                       {
                           "url": "https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/zwserver",
                           "reference_type": "",
                           "reference_id": ""
                       }
                   ],
                   "exploitability": "0.5",
                   "weighted_severity": "0.0",
                   "risk_score": null
               },
               "gitlab_importer_v2/CVE-2017-16149": {
                   "advisory_id": "gitlab_importer_v2/CVE-2017-16149",
                   "url": "https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/zwserver/CVE-2017-16149.yml",
                   "aliases": [],
                   "summary": "Path Traversal\nzwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing `../` in the url.",
                   "severities": [],
                   "weaknesses": [
                       {
                           "cwe_id": "22",
                           "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                           "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."
                       },
                       {
                           "cwe_id": "1035",
                           "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
                           "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
                       },
                       {
                           "cwe_id": "937",
                           "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
                           "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
                       }
                   ],
                   "references": [
                       {
                           "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16149",
                           "reference_type": "",
                           "reference_id": "CVE-2017-16149"
                       }
                   ],
                   "exploitability": "0.5",
                   "weighted_severity": "0.0",
                   "risk_score": null
               },
               "gitlab_importer_v2/GMS-2017-235": {
                   "advisory_id": "gitlab_importer_v2/GMS-2017-235",
                   "url": "https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/zwserver/GMS-2017-235.yml",
                   "aliases": [],
                   "summary": "Directory Traversal\n`zwserver` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url./n",
                   "severities": [],
                   "weaknesses": [
                       {
                           "cwe_id": "1035",
                           "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
                           "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
                       },
                       {
                           "cwe_id": "937",
                           "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
                           "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
                       }
                   ],
                   "references": [
                       {
                           "url": "https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/zwserver",
                           "reference_type": "",
                           "reference_id": ""
                       }
                   ],
                   "exploitability": "0.5",
                   "weighted_severity": "0.0",
                   "risk_score": null
               },
               "github_importer_v2/GHSA-whcm-29f4-j4mx": {
                   "advisory_id": "github_importer_v2/GHSA-whcm-29f4-j4mx",
                   "url": "https://github.com/advisories/GHSA-whcm-29f4-j4mx",
                   "aliases": [
                       "CVE-2017-16149"
                   ],
                   "summary": "Directory Traversal in zwserver",
                   "severities": [
                       {
                           "url": "https://github.com/advisories/GHSA-whcm-29f4-j4mx",
                           "value": "HIGH",
                           "scoring_system": "cvssv3.1_qr",
                           "scoring_elements": ""
                       }
                   ],
                   "weaknesses": [
                       {
                           "cwe_id": "22",
                           "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                           "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."
                       }
                   ],
                   "references": [
                       {
                           "url": "https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/zwserver",
                           "reference_type": "",
                           "reference_id": ""
                       },
                       {
                           "url": "https://www.npmjs.com/advisories/372",
                           "reference_type": "",
                           "reference_id": ""
                       },
                       {
                           "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16149",
                           "reference_type": "",
                           "reference_id": "CVE-2017-16149"
                       },
                       {
                           "url": "https://github.com/advisories/GHSA-whcm-29f4-j4mx",
                           "reference_type": "",
                           "reference_id": "GHSA-whcm-29f4-j4mx"
                       }
                   ],
                   "exploitability": "0.5",
                   "weighted_severity": "8.0",
                   "risk_score": 4.0
               }
           },
           "packages": [
               {
                   "purl": "pkg:npm/zwserver@0.1.0",
                   "affected_by_vulnerabilities": {
                       "github_importer_v2/GHSA-whcm-29f4-j4mx": {
                           "advisory_id": "github_importer_v2/GHSA-whcm-29f4-j4mx",
                           "fixed_by_packages": null,
                           "code_fixes": []
                       },
                       "gitlab_importer_v2/CVE-2017-16149": {
                           "advisory_id": "gitlab_importer_v2/CVE-2017-16149",
                           "fixed_by_packages": null,
                           "code_fixes": []
                       },
                       "gitlab_importer_v2/GMS-2017-235": {
                           "advisory_id": "gitlab_importer_v2/GMS-2017-235",
                           "fixed_by_packages": null,
                           "code_fixes": []
                       },
                       "gitlab_importer_v2/npm/zwserver/CVE-2017-16149": {
                           "advisory_id": "gitlab_importer_v2/npm/zwserver/CVE-2017-16149",
                           "fixed_by_packages": null,
                           "code_fixes": []
                       },
                       "gitlab_importer_v2/npm/zwserver/GMS-2017-235": {
                           "advisory_id": "gitlab_importer_v2/npm/zwserver/GMS-2017-235",
                           "fixed_by_packages": null,
                           "code_fixes": []
                       }
                   },
                   "fixing_vulnerabilities": [],
                   "risk_score": 4.0
               }
           ]
       }
   }
   
6. TG1999

   closed this as completedon Jul 15, 2025
7. github-project-automation

   moved this to Done in 04-VulnerableCode nexton Jul 15, 2025
8. pombredanne

   added this to 00-AboutCodePlanneron Jul 22, 2025
9. pombredanne

   moved this to Done in 00-AboutCodePlanneron Jul 22, 2025
10. pombredanne

    moved this from Done to Validated in 00-AboutCodePlanneron Aug 12, 2025
11. pombredanne

    assigned

    pombredanne

    and unassigned

    TG1999

    on May 12, 2026