dradis-nessus 3.21.0 → 4.2.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (9) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +43 -49
  3. data/CHANGELOG.template +12 -0
  4. data/dradis-nessus.gemspec +1 -1
  5. data/lib/dradis/plugins/nessus/gem_version.rb +2 -2
  6. data/lib/nessus/report_item.rb +11 -8
  7. data/templates/report_item.fields +34 -24
  8. data/templates/report_item.sample +10 -0
  9. metadata +9 -8
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 35a847aee9242430eb7d2b88de6e33d642836604cc2e71465d1ac739c6f5782a
4
- data.tar.gz: d4a58032c0e0ad9a1112e1611cd57b1804dad49c9a85c702d0ec8d4b2f1502e6
3
+ metadata.gz: 39e68f750e4e6f16e4b203440d84bcf981794d2835c74349eb8bf4e383a059ee
4
+ data.tar.gz: 3302fca0e112a5be6bae321bdf7d6bb666469a1f44a44b8d9da7722c443363a1
5
5
  SHA512:
6
- metadata.gz: ea107ba13c04f4fe79f259dc05b1d1a206ba737684854010b49e909b84d232701bf8e79cfd6d4ac071ecbf9a24345e98424357f8b9004ecc0a1983cd5209dcee
7
- data.tar.gz: 94e26f9da628ea5be6fc124e8b9310513b4e4284fd3cef14a32361326b7dae805fbbc5650db7529fd34df2bde80964462324d150d25bc0a691f61ed6fcb8753d
6
+ metadata.gz: 45476d65333d912cca4636f6e737669bd4950bf00d7767c7e108fc8a746e192aecae105e68c779419bc771b469404cbd8492e610a1159cb4e32a4f8b294373f5
7
+ data.tar.gz: 145f623c1d58cff49d95a3cc2b78844d0d863fc7395d19b41cd530456cf22d23a0d5d9d893b67c1fe7dea4ad72e64d8dec85859d07c53cb21f312d9da97617e6
data/CHANGELOG.md CHANGED
@@ -1,68 +1,62 @@
1
- ## Dradis Framework 3.21 (February, 2021) ##
1
+ v4.2.0 (February 2022)
2
+ - No changes
2
3
 
3
- * No changes.
4
+ v4.1.0 (November 2021)
5
+ - Add product_coverage & cvss3_impact_score as available Issue fields
4
6
 
5
- ## Dradis Framework 3.20 (December, 2020) ##
7
+ v4.0.0 (July 2021)
8
+ - Add age_of_vuln, exploit_code_maturity, threat_intensity_last_28 threat_recency, & threat_sources_last_28 as available Issue fields
6
9
 
7
- * No changes.
10
+ v3.22.0 (April 2021)
11
+ - Add report_item.cvss3_temporal_score & report_item.cvss3_temporal_vector as available fields
12
+ - Add report_item.vpr_score as an available field
8
13
 
9
- ## Dradis Framework 3.19 (September, 2020) ##
14
+ v3.21.0 (February 2021)
15
+ - No changes
10
16
 
11
- * No changes.
17
+ v3.20.0 (December 2020)
18
+ - No changes
12
19
 
13
- ## Dradis Framework 3.18 (July, 2020) ##
20
+ v3.19.0 (September 2020)
21
+ - No changes
14
22
 
15
- * No changes.
23
+ v3.18.0 (July 2020)
24
+ - No changes
16
25
 
17
- ## Dradis Framework 3.17 (May, 2020) ##
26
+ v3.17.0 (May 2020)
27
+ - No changes
18
28
 
19
- * No changes.
29
+ v3.16.0 (February 2020)
30
+ - No changes
20
31
 
21
- ## Dradis Framework 3.16 (February, 2020) ##
32
+ v3.15.0 (November 2019)
33
+ - Fixed bullet points formatting to handle internal text column widths
22
34
 
23
- * No changes.
35
+ v3.14.0 (August 2019)
36
+ - No changes
24
37
 
25
- ## Dradis Framework 3.15 (November, 2019) ##
38
+ v3.13.0 (June 2019)
39
+ - No changes
26
40
 
27
- * Fixed bullet points formatting to handle internal text column widths
41
+ v3.12.0 (March 2019)
42
+ - No changes
28
43
 
29
- ## Dradis Framework 3.14 (August, 2019) ##
44
+ v3.11.0 (November 2018)
45
+ - No changes
30
46
 
31
- * No changes.
47
+ v3.10.0 (August 2018)
48
+ - Make Issue Title available at the Evidence level
49
+ - Split services data into services and services_extra tables
50
+ - Update default configuration to match Welcome templates
32
51
 
33
- ## Dradis Framework 3.13 (June, 2019) ##
52
+ v3.9.0 (January 2018)
53
+ - Correctly format bullet lists whether separated by 1 or 2 new lines
34
54
 
35
- * No changes.
55
+ v3.8.0 (September 2017)
56
+ - Added CVSSv3 fields
36
57
 
37
- ## Dradis Framework 3.12 (March, 2019) ##
58
+ v3.7.0 (July 2017)
59
+ - No changes
38
60
 
39
- * No changes.
40
-
41
- ## Dradis Framework 3.11 (November, 2018) ##
42
-
43
- * No changes.
44
-
45
- ## Dradis Framework 3.10 (August, 2018) ##
46
-
47
- * Make Issue Title available at the Evidence level
48
-
49
- * Update default configuration to match Welcome templates
50
-
51
- * Split services data into services and services_extra tables
52
-
53
- ## Dradis Framework 3.9 (January, 2018) ##
54
-
55
- * Correctly format bullet lists whether separated by
56
- 1 or 2 new lines
57
-
58
- ## Dradis Framework 3.8 (September, 2017) ##
59
-
60
- * Added CVSSv3 fields.
61
-
62
- ## Dradis Framework 3.7 (July, 2017) ##
63
-
64
- * No changes.
65
-
66
- ## Dradis Framework 3.6 (March, 2017) ##
67
-
68
- * No changes.
61
+ v3.6.0 (March 2017)
62
+ - No changes
data/CHANGELOG.template ADDED
@@ -0,0 +1,12 @@
1
+ [v#.#.#] ([month] [YYYY])
2
+ - [future tense verb] [feature]
3
+ - Upgraded gems:
4
+ - [gem]
5
+ - Bugs fixes:
6
+ - [future tense verb] [bug fix]
7
+ - Bug tracker items:
8
+ - [item]
9
+ - Security Fixes:
10
+ - High: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description]
11
+ - Medium: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description]
12
+ - Low: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description]
data/dradis-nessus.gemspec CHANGED
@@ -25,7 +25,7 @@ Gem::Specification.new do |spec|
25
25
  # versions of Rails (a sure recipe for disaster, I'm sure), which is needed
26
26
  # until we bump Dradis Pro to 4.1.
27
27
  # s.add_dependency 'rails', '~> 4.1.1'
28
- spec.add_dependency 'dradis-plugins', '~> 3.6'
28
+ spec.add_dependency 'dradis-plugins', '~> 4.0'
29
29
  spec.add_dependency 'nokogiri'
30
30
 
31
31
  spec.add_development_dependency 'bundler', '~> 1.6'
data/lib/dradis/plugins/nessus/gem_version.rb CHANGED
@@ -7,8 +7,8 @@ module Dradis
7
7
  end
8
8
 
9
9
  module VERSION
10
- MAJOR = 3
11
- MINOR = 21
10
+ MAJOR = 4
11
+ MINOR = 2
12
12
  TINY = 0
13
13
  PRE = nil
14
14
 
data/lib/nessus/report_item.rb CHANGED
@@ -19,15 +19,17 @@ module Nessus
19
19
  def supported_tags
20
20
  [
21
21
  # attributes
22
- :port, :svc_name, :protocol, :severity, :plugin_id, :plugin_name, :plugin_family,
22
+ :plugin_family, :plugin_id, :plugin_name, :port, :protocol, :svc_name, :severity,
23
23
  # simple tags
24
- :solution, :risk_factor, :description, :plugin_publication_date,
25
- :metasploit_name, :cvss_vector, :cvss3_vector, :cvss_temporal_vector, :synopsis,
26
- :exploit_available, :patch_publication_date, :plugin_modification_date,
27
- :cvss_temporal_score, :cvss_base_score, :cvss3_base_score, :plugin_output,
28
- :plugin_version, :exploitability_ease, :vuln_publication_date,
29
- :exploit_framework_canvas, :exploit_framework_metasploit,
30
- :exploit_framework_core,
24
+ :age_of_vuln, :cvss3_base_score, :cvss3_temporal_score, :cvss3_temporal_vector,
25
+ :cvss3_vector, :cvss_base_score, :cvss3_impact_score, :cvss_temporal_score,
26
+ :cvss_temporal_vector, :cvss_vector, :description, :exploit_available,
27
+ :exploit_code_maturity, :exploit_framework_canvas, :exploit_framework_core,
28
+ :exploitability_ease, :exploit_framework_metasploit,:metasploit_name,
29
+ :patch_publication_date, :plugin_modification_date, :plugin_output,
30
+ :plugin_publication_date, :plugin_version, :product_coverage, :risk_factor,
31
+ :solution, :synopsis, :threat_intensity_last_28, :threat_recency,
32
+ :threat_sources_last_28, :vpr_score, :vuln_publication_date,
31
33
  # multiple tags
32
34
  :bid_entries, :cve_entries, :see_also_entries, :xref_entries,
33
35
  # compliance tags
@@ -68,6 +70,7 @@ module Nessus
68
70
  # @svc_name = xml.attributes["svc_name"]
69
71
  # @protocol = xml.attributes["protocol"]
70
72
  # @severity = xml.attributes["severity"]
73
+ :cvss3_impact_score => 'cvssV3_impactScore',
71
74
  :plugin_id => 'pluginID',
72
75
  :plugin_name => 'pluginName',
73
76
  :plugin_family => 'pluginFamily'
data/templates/report_item.fields CHANGED
@@ -1,33 +1,43 @@
1
- report_item.port
2
- report_item.svc_name
3
- report_item.protocol
4
- report_item.severity
5
- report_item.plugin_id
6
- report_item.plugin_name
7
- report_item.plugin_family
1
+ report_item.age_of_vuln
2
+ report_item.bid_entries
3
+ report_item.cve_entries
4
+ report_item.cvss3_base_score
5
+ report_item.cvss3_impact_score
6
+ report_item.cvss3_temporal_score
7
+ report_item.cvss3_temporal_vector
8
+ report_item.cvss3_vector
9
+ report_item.cvss_base_score
10
+ report_item.cvss_temporal_score
11
+ report_item.cvss_temporal_vector
12
+ report_item.cvss_vector
13
+ report_item.description
8
14
  report_item.exploitability_ease
9
- report_item.vuln_publication_date
15
+ report_item.exploit_available
16
+ report_item.exploit_code_maturity
10
17
  report_item.exploit_framework_canvas
11
- report_item.exploit_framework_metasploit
12
18
  report_item.exploit_framework_core
13
- report_item.solution
14
- report_item.risk_factor
15
- report_item.description
16
- report_item.plugin_publication_date
19
+ report_item.exploit_framework_metasploit
17
20
  report_item.metasploit_name
18
- report_item.cvss_vector
19
- report_item.cvss3_vector
20
- report_item.cvss_temporal_vector
21
- report_item.cvss_temporal_score
22
- report_item.cvss_base_score
23
- report_item.cvss3_base_score
24
- report_item.synopsis
25
- report_item.exploit_available
26
21
  report_item.patch_publication_date
22
+ report_item.plugin_family
23
+ report_item.plugin_id
27
24
  report_item.plugin_modification_date
25
+ report_item.plugin_name
28
26
  report_item.plugin_output
27
+ report_item.plugin_publication_date
29
28
  report_item.plugin_version
30
- report_item.bid_entries
31
- report_item.cve_entries
29
+ report_item.port
30
+ report_item.product_coverage
31
+ report_item.protocol
32
+ report_item.risk_factor
32
33
  report_item.see_also_entries
33
- report_item.xref_entries
34
+ report_item.severity
35
+ report_item.solution
36
+ report_item.svc_name
37
+ report_item.synopsis
38
+ report_item.threat_intensity_last_28
39
+ report_item.threat_recency
40
+ report_item.threat_sources_last_28
41
+ report_item.vpr_score
42
+ report_item.vuln_publication_date
43
+ report_item.xref_entries
data/templates/report_item.sample CHANGED
@@ -7,6 +7,7 @@
7
7
  pluginName="Apache Chunked Encoding Remote Overflow"
8
8
  pluginFamily="Web Servers">
9
9
 
10
+ <age_of_vuln>730 days +</age_of_vuln>
10
11
  <exploitability_ease>Exploits are available</exploitability_ease>
11
12
  <vuln_publication_date>2002/06/19</vuln_publication_date>
12
13
  <exploit_framework_canvas>true</exploit_framework_canvas>
@@ -24,15 +25,24 @@ If safe checks are enabled, this may be a false positive since it is based on th
24
25
  <plugin_publication_date>2002/06/17</plugin_publication_date>
25
26
  <metasploit_name>Apache Win32 Chunked Encoding</metasploit_name>
26
27
  <cvss3_base_score>3.7</cvss3_base_score>
28
+ <cvss3_temporal_score>6.8</cvss3_temporal_score>
29
+ <cvss3_temporal_vector>CVSS:3.0/E:U/RL:O/RC:C</cvss3_temporal_vector>
27
30
  <cvss3_vector>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N</cvss3_vector>
31
+ <cvssV3_impactScore>5.9</cvssV3_impactScore>
28
32
  <cvss_vector>CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P</cvss_vector>
29
33
  <synopsis>The remote web server is vulnerable to a remote code execution attack.</synopsis>
34
+ <threat_intensity_last_28>Very Low</threat_intensity_last_28>
35
+ <threat_recency>&gt; 365 days</threat_recency>
36
+ <threat_sources_last_28>No recorded events</threat_sources_last_28>
30
37
  <plugin_type>remote</plugin_type>
31
38
  <see_also>http://httpd.apache.org/info/security_bulletin_20020617.txt</see_also>
32
39
  <see_also>http://httpd.apache.org/info/security_bulletin_20020620.txt</see_also>
33
40
  <exploit_available>true</exploit_available>
41
+ <exploit_code_maturity>Unproven</exploit_code_maturity>
34
42
  <plugin_modification_date>2011/03/08</plugin_modification_date>
35
43
  <cvss_base_score>7.5</cvss_base_score>
44
+ <vpr_score>6.7</vpr_score>
45
+ <product_coverage>Low</product_coverage>
36
46
  <canvas_package>CANVAS</canvas_package>
37
47
  <cve>CVE-2002-0392</cve>
38
48
  <bid>5033</bid>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: dradis-nessus
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.21.0
4
+ version: 4.2.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Daniel Martin
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-02-12 00:00:00.000000000 Z
11
+ date: 2022-02-14 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: dradis-plugins
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - "~>"
18
18
  - !ruby/object:Gem::Version
19
- version: '3.6'
19
+ version: '4.0'
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - "~>"
25
25
  - !ruby/object:Gem::Version
26
- version: '3.6'
26
+ version: '4.0'
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: nokogiri
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -107,6 +107,7 @@ files:
107
107
  - ".gitignore"
108
108
  - ".rspec"
109
109
  - CHANGELOG.md
110
+ - CHANGELOG.template
110
111
  - CONTRIBUTING.md
111
112
  - Gemfile
112
113
  - LICENSE
@@ -143,7 +144,7 @@ homepage: http://dradisframework.org
143
144
  licenses:
144
145
  - GPL-2
145
146
  metadata: {}
146
- post_install_message:
147
+ post_install_message:
147
148
  rdoc_options: []
148
149
  require_paths:
149
150
  - lib
@@ -158,8 +159,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
158
159
  - !ruby/object:Gem::Version
159
160
  version: '0'
160
161
  requirements: []
161
- rubygems_version: 3.2.4
162
- signing_key:
162
+ rubygems_version: 3.1.4
163
+ signing_key:
163
164
  specification_version: 4
164
165
  summary: Nessus upload add-on for the Dradis Framework.
165
166
  test_files: