---
sourceDocument: Store Version History Release Notes
sourceDocumentLink: https://www.servicenow.com/docs/r/store-release-notes

 Release :

    - store

ft:locale :

    - en-US

ft:publication_title :

    - Store Version History Release Notes

ft:clusterId :

    - rnst

bundleId :

    - rnst


---

# Vulnerability Response Integration with Black Duck release notes

# Vulnerability Response Integration with Black Duck release notes {#ariaid-title1}

Release version: Store  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Vulnerability Response Integration with Black Duck release notes

The Vulnerability Response Integration with Black Duck application on the ServiceNow Store enables customers to integrate Black Duck vulnerability data with ServiceNow Vulnerability Response.
This integration helps prioritize and remediate application vulnerabilities by importing Black Duck scan results, mapping vulnerability data accurately, and managing project lifecycle states within ServiceNow.
Show full answer Show less  

## Key Features and Enhancements

* **Accurate Import of Vulnerability Data:** The integration now correctly handles Black Duck vulnerability scan imports, especially when CVSS v3 impact sub-scores are null or empty, ensuring no reported vulnerabilities are missed.
* **Proper Classification of CVE-based Vulnerabilities:** Vulnerabilities with CVE prefixes are correctly stored as NVD entry records (rather than Application Vulnerability Entry records), preserving accurate CVE metadata, severity, and impact scoring.
* **Security Enhancements:** Added query and field-specific Access Control Lists (ACLs) for Black Duck configuration and project tables to align with ServiceNow Platform Security standards.
* **Improved Data Attributes:** The application now includes additional attributes such as shortdescription, sourceriskscore, v3impactsubscore, and statusupdatedon in the vulnerability attributes table, enhancing visibility on UI lists and forms.
* **Mapping Enhancements:** Black Duck AVIT mapping includes the componentVersionName, improving component tracking within vulnerabilities.
* **Credential Storage Fix:** The integration correctly stores MID Server names instead of internal sysids, resolving ECC queue processing errors and ensuring smoother communication.
* **Robust Project Management:** The integration gracefully handles deleted or archived Black Duck projects and continues processing other projects when some return errors. A property (snvulblackduck.markunseenprojectsinactive) allows automatic deactivation of projects no longer present in Black Duck.
* **Administrative Updates:** Removal of admin override checks from ACLs to streamline permissions.

## Practical Benefits for ServiceNow Customers

* Reliable import and classification of Black Duck vulnerabilities ensure comprehensive and accurate vulnerability data within ServiceNow Vulnerability Response.
* Security enhancements and ACL updates help maintain compliance with platform security standards.
* Improved handling of project lifecycle states and credential storage reduces integration errors and operational disruptions.
* Visibility into critical vulnerability attributes via the UI supports better prioritization and remediation planning.

## Version Highlights

* **Version 30.5.1 (September 2026):** Fixed import issues related to null CVSS v3 sub-scores and corrected CVE-based vulnerability classification.
* **Version 30.2.1 (June 2026):** Added ACLs for security compliance and enhanced vulnerability attribute data.
* **Version 30.1.1 (April 2026):** Enhanced mapping, credential storage fix, and improved project error handling.
* **Initial Release (May 2024):** Provided foundational integration to prioritize and remediate Black Duck application vulnerabilities within ServiceNow.  
Version history for the Vulnerability Response Integration with Black Duck application on the ServiceNow Store.
Important:  
For details on system requirements and family compatibility, view the application listing on the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website.

## Version history

Version 30.5.1 - September 2026 (USEM)
:
    * Fixed:
      * An issue with Black Duck vulnerability scan results import failures if the CVSS v3 impact sub-score returned by Black Duck was null or empty. By including the impact sub-score in the imported record only when Black Duck provides a valid, non-empty value, records without one now are imported as expected. This correction ensures all reported Black Duck vulnerability items import successfully.
      * An issue with CVE-based vulnerabilities identified by Black Duck that were being stored as Application Vulnerability Entry records instead of NVD entry records and potentially impacted severity and CVSS impact scoring. By treating records that contain a CVE prefix as NVD entry records and storing them accordingly, entries without a CVE prefix continue to be recorded as Application Vulnerability Entry records. This correction restores the proper classification so CVE metadata and impact scoring are associated with the appropriate NVD entries.
      {#store-secops-rn-vr-int-blackduck__ul_w4b_q5p_lkc}

Version 1.1.5 - September 2026
:
    * Fixed:
      * An issue with Black Duck vulnerability scan results import failures if the CVSS v3 impact sub-score returned by Black Duck was null or empty. By including the impact sub-score in the imported record only when Black Duck provides a valid, non-empty value, records without one now are imported as expected. This correction ensures all reported Black Duck vulnerability items import successfully.
      * An issue with CVE-based vulnerabilities identified by Black Duck that were being stored as Application Vulnerability Entry records instead of NVD entry records and potentially impacted severity and CVSS impact scoring. By treating records that contain a CVE prefix as NVD entry records and storing them accordingly, entries without a CVE prefix continue to be recorded as Application Vulnerability Entry records. This correction restores the proper classification so CVE metadata and impact scoring are associated with the appropriate NVD entries.
      {#store-secops-rn-vr-int-blackduck__ul_qxl_q5p_lkc}

Version 30.2.1 - June 2026 (USEM)
:
    * The following enhancements and changes support internal security directives:
      * Query ACLs added to Black Duck configuration and project tables: sn_vul_blackduck_config and sn_vul_blackduck_project, plus narrow field-specific ACLs for u_source on the Black Duck app-import and project-import staging tables to align with ServiceNow Platform Security guidance.
      * Fix scripts run exactly once per upgrade.
      * Fix script renamed to a per-plugin name to prevent update set conflicts with other Security Operations plugins.
      {#store-secops-rn-vr-int-blackduck__ul_pbx_y5f_kjc}
    * Fixed: CVDB framework alignment --- Four missing columns added to sn_vul_blackduck_cvd_attributes: short_description, source_risk_score, v3_impact_subscore, status_updated_on so the CVD attributes table fully matches what the Black Duck integration produces. The UI list and form sections now expose these values.

Version 30.1.1 - April 2026 (USEM)
:
    * New: Enhancements to Black Duck AVIT mapping to include componentVersionName.
    * Fixed:
      * Black Duck integration configuration so it correctly stores the MID Server name instead of the internal sys_id when saving credentials. This enhancement resolves ECC queue entries that are stuck in the "Ready" state with the error message,"No response for ECC message request after waiting for 30 seconds in ECC Queue."
      * Integration now gracefully handles deleted or archived projects. Integration runs continue processing remaining projects even when individual projects return 404 errors. Activate the sn_vul_blackduck.mark_unseen_projects_inactive property to automatically deactivate projects no longer present in Black Duck.
      {#store-secops-rn-vr-int-blackduck__ul_smr_vr4_53c}
    {#store-secops-rn-vr-int-blackduck__ul_rmr_vr4_53c}

Version 1.1.2 - April 2026
:
    * New: Enhancements to Black Duck AVIT mapping to include componentVersionName.
    * Fixed:
      * Black Duck integration configuration so it correctly stores the MID Server name instead of the internal sys_id when saving credentials. This enhancement resolves ECC queue entries that are stuck in the "Ready" state with the error message,"No response for ECC message request after waiting for 30 seconds in ECC Queue."
      * Integration now gracefully handles deleted or archived projects. Integration runs continue processing remaining projects even when individual projects return 404 errors. Activate the sn_vul_blackduck.mark_unseen_projects_inactive property to automatically deactivate projects no longer present in Black Duck.
      {#store-secops-rn-vr-int-blackduck__ul_lz3_vr4_53c}
    {#store-secops-rn-vr-int-blackduck__ul_urs_5r4_53c}

Version 1.1.1 - December 2025
:   Removed: Admin override check has been removed from the ACLs.

Version 1.0.5 - May 2024
:   Integrate your Black Duck account with ServiceNow Vulnerability Response to prioritize and remediate application vulnerabilities.{#store-secops-rn-vr-int-blackduck__latest-store-secops-rn-vr-int-blackduck}
{#store-secops-rn-vr-int-blackduck__latest-store-secops-rn-vr-int-blackduck}