search

logpresso / CVE-2021-44228-Scanner

Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
Apache License 2.0
854 stars 175 forks source link

Option to disable specific checks #222

Open nedjitef opened 2 years ago

nedjitef commented 2 years ago

Hi,

there is at least one CVE around, which requie the attacker to have write access to the configuration. Now I saw another one and kind of lost track of it.

Not sure, but if it's not a single CVE but two, would it be possible to add an option to opt out scanning for CVEs, where write access to a configuration file is required?

Checking log4j doesn't help much, if the attacker already has write access to parts of the application.

tsaibabu4u commented 2 years ago

It would be nice option to skip specific or some of CVE-2021-xxx from scanning