aquasecurity / kube-hunter

Hunt for security weaknesses in Kubernetes clusters
Apache License 2.0
4.65k stars 578 forks source link

kube-hunter results display different severity values for the same checks #549

Closed KiranBodipi closed 3 months ago

KiranBodipi commented 5 months ago

Severity value discrepancy in kube-hunter report and the vulnerability severity displayed in avd_reference URL(Aqua Vulnerability Database Doc) Example: The vulnerability ID KHV002 is a high-severity vulnerability as per kubehunter result, however when we click on the link to collect more information about the severity of KHV002 the website Aqua Vulnerability Database shows the KHV002 as a low-severity vulnerability. kubehunter-khv002

KHV002-severity-vuln-database

Similarly, we have found the discrepancy with below kube-hunter checks as well. Check KubeHunter Severity Vulnerability Database Severity KHV036 High Critical KHV052 Medium High

This behaviour can be same across many checks. Please do the needful.

Expected behaviour

The severity value should be same, both in the kube-hunter report and the value displayed in avd_reference url