CIRCL CVE Search

Searches for CVE information using circl.lu.

Vulnerability Management · CIRCL

Details

IDCIRCL CVE Search
ProviderOpen Source
CategoryVulnerability Management
From Version6.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Searches for CVE information using circl.lu.

Configure CIRCL CVE Search in Cortex

Parameter Description Required
Source Reliability Reliability of the source providing the intelligence data. True
Server URL   True
Use system proxy settings   False
Trust any certificate (not secure)   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cve-latest

Deprecated. use NVD feed 2.0 instead.
Returns the latest updated CVEs.

Base Command

cve-latest

Input

Argument Name Description Required
limit The maximum number of CVEs to display. Optional

Context Output

Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS Number The CVSS score of the CVE.
CVE.Published Date The date the CVE was published.
CVE.Modified Date The date that the CVE was last modified.
CVE.Description String The description of the CVE.
DBotScore.Indicator String The indicator value.
DBotScore.Score Number The indicator score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor reporting the score of the indicator.
Human Readable Output
   
CVSS The CVE CVSS Score
Description CVE Description
ID CVE ID
Modified The date the CVE was modified
Published The date the CVE was published

cve

Returns CVE information by CVE ID.

Base Command

cve

Input

Argument Name Description Required
cve A comma-separated list of CVE IDs to search Required

Context Output

Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS.Score Number The CVSS score of the CVE.
CVE.CVSS.Vector String The CVSS vector of the CVE.
CVE.CVSS.Table Dict The CVSS table of the CVE.
CVE.Published Date The date the CVE was published.
CVE.Modified Date The date that the CVE was last modified.
CVE.Description String The description of the CVE.
CVE.vulnerableconfigurations Dict Vulnerable configurations in CPE format
CVE.vulnerableproduct Dict Vulnerable products in CPE format
CVE.Tags List A list of tags
CVE.Relationships List List of relationships for the CVE
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
Command Example

!cve cve=CVE-2014-1234

Context Example
{
    "CVE": [
        {
            "ID": "CVE-2014-1234",
            "Published": "2014-01-10T12:02:00",
            "CVSS": 2.1,
            "Modified": "2014-01-10T17:57:00",
            "Description": "The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process."
        }
    ]
}
Human Readable Output
   
CVSS 4.3
Description XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.
ID CVE-2022-1234
Modified 2022-04-13T15:03:00
Published 2022-04-06T04:15:00

Configuration parameters

  • integration_reliability — Source Reliability (required)
  • url — Server URL (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (2)

  • cve

    Returns CVE information by CVE ID.

  • cve-latest Deprecated

    Returns the latest updated CVEs. Deprecated. Use the NVD Feed v2.0 integration instead

Source

CirclCVESearch.py CirclCVESearch_test.py CirclCVESearch.yml CirclCVESearch_description.md
Download History Raw 
category: Vulnerability Management
provider: Open Source
commonfields:
  id: CIRCL CVE Search
  version: -1
sectionorder:
  - Connect
  - Collect
configuration:
- name: integration_reliability
  display: Source Reliability
  section: Connect
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A+ - 3rd party enrichment
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- defaultvalue: https://cve.circl.lu/api/
  display: Server URL
  section: Connect
  name: url
  required: true
  type: 0
- display: Use system proxy settings
  section: Connect
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  section: Connect
  name: insecure
  type: 8
  required: false
description: Searches for CVE information using circl.lu.
display: CIRCL CVE Search
name: CIRCL CVE Search
script:
  commands:
  - arguments:
    - description: The maximum number of CVEs to display.
      name: limit
    description: Returns the latest updated CVEs. Deprecated. Use the NVD Feed v2.0 integration instead
    deprecated: true
    name: cve-latest
    outputs:
    - contextPath: CVE.ID
      description: The ID of the CVE.
      type: String
    - contextPath: CVE.CVSS
      description: The CVSS score of the CVE.
      type: number
    - contextPath: CVE.Published
      description: The date the CVE was published.
      type: Date
    - contextPath: CVE.Modified
      description: The date that the CVE was last modified.
      type: Date
    - contextPath: CVE.Description
      description: The description of the CVE.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator value.
      type: String
    - contextPath: DBotScore.Score
      description: The indicator score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor reporting the score of the indicator.
      type: String
  - arguments:
    - default: true
      description: 'The CVE ID. For example: CVE-2014-1234.'
      isArray: true
      name: cve
      required: true
    description: Returns CVE information by CVE ID.
    name: cve
    outputs:
    - contextPath: CVE.ID
      description: The ID of the CVE.
      type: String
    - contextPath: CVE.CVSS.Score
      description: The CVSS score of the CVE.
      type: number
    - contextPath: CVE.CVSS.Vector
      description: The CVSS Vector of the CVE.
      type: String
    - contextPath: CVE.CVSS.Table
      description: The CVSS table of the CVE.
      type: String
    - contextPath: CVE.Published
      description: The date the CVE was published.
      type: Date
    - contextPath: CVE.Modified
      description: The date that the CVE was last modified.
      type: Date
    - contextPath: CVE.Description
      description: The description of the CVE.
      type: String
    - contextPath: CVE.Tags
      description: A list of tags.
      type: List
    - contextPath: CVE.Relationships
      description: A list of relationships of the CVE.
      type: List
    - contextPath: CVE.vulnerableconfigurations
      description: A dictionary of CPE strings with `cpe` key for a grid.
      type: String
    - contextPath: CVE.vulnerableproduct
      description: A dictionary of CPE strings with `cpe` key for a grid.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- CIRCL CVE Search - Test
fromversion: 6.5.0