Can we manually create a vulnerability?

nancym
ServiceNow Employee
ServiceNow Employee

‎10-23-2023 01:38 PM

Is it possible to create a vulnerability manually through the UI? Not a VIT, rather an entry under "Libraries" in either NVD, CWE or third-party? Not seeing a "NEW" button out-of-the-box, or in any of the other Libraries for that matter. Has anyone had to address this use case? 

thank you,

Nancy

0 Helpfuls
  • 874 Views
3 REPLIES 3

Simon Hendery
Mega Patron
Mega Patron

‎10-23-2023 02:17 PM

Hi @nancym, I see you are a ServiceNow account manager ... is this a query from a customer?

 

I'm not sure what the use case behind this question would be. The NVD & CWE entries are external libraries/data sources, so I don't know why anyone would want to add anything to them.

 

Are you able to provide any additional context?

0 Helpfuls

nancym
ServiceNow Employee
ServiceNow Employee
In response to Simon Hendery

‎10-23-2023 02:47 PM

This is in the context of application pen testing. Manual findings are submitted from the internal pen testing team. The class of vulnerabilities that they discover doesn't exist so they can't create a VIT if there isn't a corresponding class in the system. For example, they are doing an application pen test and find a SQL injection vulnerability, so that would be an instance of SQL injection, but if there is no SQL injection class, they have no frame of reference to create a vulnerable item. How do we manipulate the vulnerabilities database so they can add and modify at will?

So I've been doing more research and I found this: https://docs.servicenow.com/bundle/vancouver-security-management/page/product/vulnerability-app-vuln...

 

I think that is the solution, do you agree? 

thank you,
Nancy

Simon Hendery
Mega Patron
Mega Patron
In response to nancym

‎10-23-2023 05:01 PM

That's the correct part of docs to look at. You may want to go back up to the start of the pen testing AVR section to get a full overview: 

https://docs.servicenow.com/bundle/vancouver-security-management/page/product/vulnerability-app-vuln...

 

If I understand correctly, everything required to do what you want to do is available out-of-the-box, but you need the pen-testing team to provide a CWE related to each vulnerable item - i.e. the CWE is the 'class of vulnerability'.

 

For example, in the screenshot below, the entry in the Application Vulnerability Entry table references CWE-564 (SQL Injection: Hibernate).

 

pen-test.png

 

Does that help at all?

0 Helpfuls