search

CVEProject / cve-website

The new CVE website
66 stars 35 forks source link

meaning of a CWE ID is sometimes omitted #3019

Open ElectricNroff opened 3 weeks ago

ElectricNroff commented 3 weeks ago

https://github.com/CVEProject/cve-website/blob/103e3c109171d26fbd39525d34fefa809d91a3d5/src/components/AdpVulnerabilityEnrichment.vue#L140-L141 For example, https://cveawg.mitre.org/api/cve/CVE-2023-0594 has:

"problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",

and https://www.cve.org/CVERecord?id=CVE-2023-0594 renders this as:

CWE
Learn more
CWE-79: CWE-79

I feel that, if cweId is present, then fields such as problemTypes[0].descriptions[0].description should be ignored, and the text to the right of the colon should be obtained from the CWE project, e.g., https://cwe-api.mitre.org/api/v1/cwe/weakness/79 under weaknesses[0].Name in this situation.