vulsio / go-cve-dictionary

Build a local copy of CVE (NVD and Japanese JVN). Server mode for easy querying.
Apache License 2.0
368 stars 109 forks source link

feat(db,server): add GetCveIDs #358

Closed MaineK00n closed 7 months ago

MaineK00n commented 10 months ago

What did you implement:

This PR allows you to obtain the CVE ID list registered in the DB.

Type of change

How Has This Been Tested?

$ curl http://127.0.0.1:1323/cves/ids
["CVE-2023-21043","CVE-2023-37256", ... ,"CVE-2023-46765"]

$ curl -X POST  -H "Content-Type: application/json" --data '["CVE-2023-0706", "CVE-2023-2569"]' http://127.0.0.1:1323/cves | jq
{
  "CVE-2023-0706": {
    "CveID": "CVE-2023-0706",
    "Nvds": [
      {
        "CveID": "CVE-2023-0706",
        "Descriptions": [
          {
            "Lang": "en",
            "Value": "A vulnerability, which was classified as critical, has been found in SourceCodester Medical Certificate Generator App 1.0. Affected by this issue is some unknown functionality of the file manage_record.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-220340."
          }
        ],
        "Cvss2": [
          {
            "Source": "cna@vuldb.com",
            "Type": "Secondary",
            "VectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "AccessVector": "NETWORK",
            "AccessComplexity": "LOW",
            "Authentication": "SINGLE",
            "ConfidentialityImpact": "PARTIAL",
            "IntegrityImpact": "PARTIAL",
            "AvailabilityImpact": "PARTIAL",
            "BaseScore": 6.5,
            "Severity": "MEDIUM",
            "ExploitabilityScore": 8,
            "ImpactScore": 6.4,
            "ObtainAllPrivilege": false,
            "ObtainUserPrivilege": false,
            "ObtainOtherPrivilege": false,
            "UserInteractionRequired": false
          }
        ],
        "Cvss3": [
          {
            "Source": "nvd@nist.gov",
            "Type": "Primary",
            "VectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "AttackVector": "NETWORK",
            "AttackComplexity": "LOW",
            "PrivilegesRequired": "LOW",
            "UserInteraction": "NONE",
            "Scope": "UNCHANGED",
            "ConfidentialityImpact": "HIGH",
            "IntegrityImpact": "HIGH",
            "AvailabilityImpact": "HIGH",
            "BaseScore": 8.8,
            "BaseSeverity": "HIGH",
            "ExploitabilityScore": 2.8,
            "ImpactScore": 5.9
          },
          {
            "Source": "cna@vuldb.com",
            "Type": "Secondary",
            "VectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "AttackVector": "NETWORK",
            "AttackComplexity": "LOW",
            "PrivilegesRequired": "LOW",
            "UserInteraction": "NONE",
            "Scope": "UNCHANGED",
            "ConfidentialityImpact": "LOW",
            "IntegrityImpact": "LOW",
            "AvailabilityImpact": "LOW",
            "BaseScore": 6.3,
            "BaseSeverity": "MEDIUM",
            "ExploitabilityScore": 2.8,
            "ImpactScore": 3.4
          }
        ],
        "Cwes": [
          {
            "Source": "cna@vuldb.com",
            "Type": "Primary",
            "CweID": "CWE-89"
          }
        ],
        "Cpes": [
          {
            "URI": "cpe:/a:medical_certificate_generator_app_project:medical_certificate_generator_app:1.0",
            "FormattedString": "cpe:2.3:a:medical_certificate_generator_app_project:medical_certificate_generator_app:1.0:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"medical_certificate_generator_app_project\", product=\"medical_certificate_generator_app\", version=\"1\\.0\", update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "medical_certificate_generator_app_project",
            "Product": "medical_certificate_generator_app",
            "Version": "1\\.0",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": "",
            "EnvCpes": []
          }
        ],
        "References": [
          {
            "Link": "https://vuldb.com/?ctiid.220340",
            "Source": "cna@vuldb.com",
            "Tags": "Permissions Required,Third Party Advisory",
            "Name": "https://vuldb.com/?ctiid.220340"
          },
          {
            "Link": "https://vuldb.com/?id.220340",
            "Source": "cna@vuldb.com",
            "Tags": "Third Party Advisory",
            "Name": "https://vuldb.com/?id.220340"
          }
        ],
        "Certs": [],
        "PublishedDate": "2023-02-07T10:15:52.61Z",
        "LastModifiedDate": "2023-11-07T04:01:16.2Z",
        "DetectionMethod": ""
      }
    ],
    "Jvns": [],
    "Fortinets": []
  },
  "CVE-2023-2569": {
    "CveID": "CVE-2023-2569",
    "Nvds": [
      {
        "CveID": "CVE-2023-2569",
        "Descriptions": [
          {
            "Lang": "en",
            "Value": "\nA CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service,\nelevation of privilege, and potentially kernel execution when a malicious actor with local user\naccess crafts a script/program using an IOCTL call in the Foxboro.sys driver.\n\n"
          }
        ],
        "Cvss2": [],
        "Cvss3": [
          {
            "Source": "nvd@nist.gov",
            "Type": "Primary",
            "VectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "AttackVector": "LOCAL",
            "AttackComplexity": "LOW",
            "PrivilegesRequired": "LOW",
            "UserInteraction": "NONE",
            "Scope": "UNCHANGED",
            "ConfidentialityImpact": "HIGH",
            "IntegrityImpact": "HIGH",
            "AvailabilityImpact": "HIGH",
            "BaseScore": 7.8,
            "BaseSeverity": "HIGH",
            "ExploitabilityScore": 1.8,
            "ImpactScore": 5.9
          },
          {
            "Source": "cybersecurity@se.com",
            "Type": "Secondary",
            "VectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "AttackVector": "LOCAL",
            "AttackComplexity": "LOW",
            "PrivilegesRequired": "LOW",
            "UserInteraction": "NONE",
            "Scope": "UNCHANGED",
            "ConfidentialityImpact": "HIGH",
            "IntegrityImpact": "HIGH",
            "AvailabilityImpact": "HIGH",
            "BaseScore": 7.8,
            "BaseSeverity": "HIGH",
            "ExploitabilityScore": 1.8,
            "ImpactScore": 5.9
          }
        ],
        "Cwes": [
          {
            "Source": "cybersecurity@se.com",
            "Type": "Primary",
            "CweID": "CWE-787"
          }
        ],
        "Cpes": [
          {
            "URI": "cpe:/a:schneider-electric:ecostruxure_foxboro_dcs_control_core_services:-",
            "FormattedString": "cpe:2.3:a:schneider-electric:ecostruxure_foxboro_dcs_control_core_services:-:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"schneider\\-electric\", product=\"ecostruxure_foxboro_dcs_control_core_services\", version=NA, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "schneider\\-electric",
            "Product": "ecostruxure_foxboro_dcs_control_core_services",
            "Version": "NA",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": "",
            "EnvCpes": []
          }
        ],
        "References": [
          {
            "Link": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf",
            "Source": "cybersecurity@se.com",
            "Tags": "Vendor Advisory",
            "Name": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf"
          }
        ],
        "Certs": [],
        "PublishedDate": "2023-06-14T08:15:09.113Z",
        "LastModifiedDate": "2023-06-22T18:06:50.047Z",
        "DetectionMethod": ""
      }
    ],
    "Jvns": [],
    "Fortinets": []
  }
}

Checklist:

You don't have to satisfy all of the following.

Is this ready for review?: YES

Reference