Vulnerability Details REST API

The Vulnerability Details REST API allows you to retrieve vulnerability details by passing a CVE ID/Sonatype vulnerability identifier or a component identifier. The response will include the root causes of the vulnerability when you pass the component identifier as a parameter in the GET request.

User permissions required to invoke this API call

No special permission is required to invoke this endpoint. This API allows anonymous access. When called anonymously, the response returns redacted vulnerability details. Authenticated requests return full vulnerability information. No specific user role or permission is required beyond authentication.

For anonymous requests, the following fields are redacted:

identifier
vulnerabilityLink
source
mainSeverity
severityScores
description
explanationMarkdown
researchType
isAdvancedVulnerabilityDetection

Methods supported:

GET (As an authenticated request)
GET (As an anonymous, non-authenticated request)

GET vulnerability details by passing a CVE or Sonatype vulnerability identifier

Vulnerability details can be retrieved by making an authenticated HTTP GET request:

GET /api/v2/vulnerabilities/{vulnerabilityId}

Where {vulnerabilityId} is a CVE or a Sonatype vulnerability identifier.

Example:

curl -u admin:admin123 'http://localhost:8070/api/v2/vulnerabilities/CVE-2017-5929'

where CVE-2017-5929 is the vulnerabilityID.

Response:

On successful execution, the response JSON returns the vulnerability details corresponding to the vulnerabilityID provided.

{
    "identifier": "CVE-2017-5929",
    "vulnIds": ["CVE-2017-5929"],
    "vulnerabilityLink": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5929",
    "source": {
        "shortName": "CVE",
        "longName": "National Vulnerability Database"
    },
    "mainSeverity": {
        "source": "cve_cvss_3",
        "score": 9.8,
        "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "severityScores": [
        {"source": "cve_cvss_2", "score": 7.5},
        {"source": "sonatype_cvss_3", "score": 9.8}
    ],
    "weakness": {
        "cweSource": "CVE",
        "cweIds": [{"id": "XXX", "uri": "https://cwe.mitre.org/data/definitions/XXX.html"}]
    },
    "categories": ["category1", "category2"],
    "description": "QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.",
    "explanationMarkdown": "The `RemoteStreamAppenderClient` class in `logback-classic` and the `SocketNode` classes in `logback-classic` and `logback-access` allow data to be deserialized over a Java `Socket`, via an `ObjectInputStream`, without validating the data beforehand.  When data is received from the `Socket`, to be logged, it is deserialized into Java objects.  An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the `Socket`, which may result in execution of arbitrary code when those objects are deserialized.\n\nNote that although `logback-core` is implicated by the Logback project [here](https://jira.qos.ch/browse/LOGBACK-1254), the Sonatype Security Research team discovered that the vulnerability is actually present in the `logback-classic` and `logback-access` components.\n\n*Advisory Deviation Notice*: The Sonatype Security Research team discovered that this vulnerability was first introduced in version 0.3.0 of `logback-classic` and version 0.6.0 of `logback-access`, as opposed to being present in *all* versions prior to 1.2.0, as stated in [the advisory](https://nvd.nist.gov/vuln/detail/CVE-2017-5929).",
    "detectionMarkdown": "Detection instructions will be provided here.",
    "recommendationMarkdown": "Recommendations will be provided here",
    "advisories": [{"referenceType": "PROJECT", "url": "http://project-url"}],
    "researchType": "DEEP_DIVE",
    "isAdvancedVulnerabilityDetection": false,
    "customData": {
        "remediation": "Please install latest version of the app",
        "cweId": "some-cwe-ids",
        "cvssVector": "some/vector",
        "cvssSeverity": 7.6
    },
    "detectionType": null
}

In the JSON response above,

mainSeverity is an official CVE severity for a given vulnerability, (if the CVE severity score does not exist it represents Sonatype severity provided by Sonatype researchers.)
severityScores are all other known severity scores not mentioned in mainSeverity.
vulnerabilityLink is the link to the official CVE description page.
vulnIds is an array containing a list of related vulnerability IDs.
customData retrieves vulnerability attributes that are customized by users, for a given vulnerability, under the requested scope. The JSON response includes the "customData" field if customized vulnerability attributes are found under the given scope.
detectionType is a string with possible values PRIMARY, SECONDARY, AST, UNSHADER, OTHER, or null (if no component identifier is provided.) It indicates the type of vulnerability detection system used to obtain the vulnerability data.

Definitions of the detectionType values:

PRIMARY: This vulnerability data has been investigated by the researcher to explicitly implicate components referenced in the feed or as a result of their independent research.

SECONDARY: This component has been implicated by our automated systems because they share vulnerable code with components that were implicated by our PRIMARY systems.

AST: This vulnerability has been discovered as part of Application Security Testing (AST) and includes common issues such as code injection, authentication flaws, and data leakage.

UNSHADER: This vulnerability has been discovered by the Shaded Vulnerability Detection algorithm.

Values for researchType:

Possible values for researchType include PUBLIC_RESEARCH and VENDOR_RESEARCH. Refer to Sonatype Vulnerability Data for more details.

Get vulnerability details by passing a component identifier

Vulnerability details can be retrieved by an authenticated HTTP GET request and passing a component identifier as a query parameter. In addition to the vulnerability details, this GET request will also retrieve the root causes of that vulnerability.

Example:

curl -u admin:admin123 'http://localhost:8070/api/v2/vulnerabilities/CVE-2022-22815?componentIdentifier=%7B%22format%22%3A%22pypi%22%2C%22coordinates%22%3A%7B%22extension%22%3A%22whl%22%2C%22name%22%3A%22Pillow%22%2C%22qualifier%22%3A%22cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64%22%2C%22version%22%3A%228.3.2%22%7D%7D'

Response:

{
    "identifier": "CVE-2022-22815",
    "vulnIds": ["CVE-2022-22815"],
    "vulnerabilityLink": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-22815",
    "source": {
        "shortName": "CVE",
        "longName": "National Vulnerability Database"
    },
    "mainSeverity": {
        "source": "cve_cvss_3",
        "score": 9.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "severityScores": [
        {"source": "cve_cvss_2", "score": 7.5},
        {"source": "sonatype_cvss_3", "score": 9.8}
    ],
    "weakness": {
        "cweSource": "CVE",
        "cweIds": [{"id": "665", "uri": "https://cwe.mitre.org/data/definitions/665.html"}]
    },
    "categories": ["data"],
    "description": "path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.",
    "explanationMarkdown": "The `Pillow` package is vulnerable due to Improper Initialization. The `alloc_array()` and `path_getbbox()` functions in the `path.c` file do not properly initialize coordinates before using them to construct path objects. A remote attacker can supply specially-crafted input that exploits the aforementioned issue to gain unauthorized access to memory, cause an application crash, or other unexpected behavior.",
    "detectionMarkdown": "The application is vulnerable by using this component.",
    "recommendationMarkdown": "We recommend upgrading to a version of this component that is not vulnerable to this specific issue.\n\nNote: If this component is included as a bundled/transitive dependency of another component, there may not be an upgrade path. In this instance, we recommend contacting the maintainers who included the vulnerable package. Alternatively, we recommend investigating alternative components or a potential mitigating control.",
    "rootCauses": [{
        "listOfPaths": ["Pillow-8.3.2.tar.gz", "Pillow-8.3.2/src/path.c"],
        "versionRange": "[5.0.0 , 9.0.0)"
    }],
    "advisories": [{"referenceType": "PROJECT", "url": "https://github.com/python-pillow/Pillow/pull/5920"},
        {"referenceType": "THIRD_PARTY", "url": "https://access.redhat.com/security/cve/cve-2022-22815"}
    ],
    "vulnerableVersionRanges": ["[8.3.2,9.0.0)"],
    "researchType": "DEEP_DIVE",
    "isAdvancedVulnerabilityDetection": false,
    "customData": {
        "remediation": "some-string",
        "cweId": "some-cwe-ids",
        "cvssVector": "some/vector",
        "cvssSeverity": 7.6
    },
    "detectionType": "PRIMARY"
}

GET vulnerability details using anonymous, non-authenticated requests

The response for anonymous, non-authenticated requests retrieves limited vulnerability details.

Example:

curl 'http://localhost:8070/api/v2/vulnerabilities/CVE-2017-5929'

Response:

{
    "identifier": "CVE-2017-5929",
    "vulnerabilityLink": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5929",
    "source": {
        "shortName": "CVE",
        "longName": "National Vulnerability Database"
    },
    "mainSeverity": {
        "source": "cve_cvss_3",
        "score": 9.8,
        "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "severityScores": [
        {"source": "cve_cvss_2", "score": 7.5},
        {"source": "sonatype_cvss_3", "score": 9.8}
    ],
    "weakness": null,
    "categories": null,
    "description": "QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.",
    "explanationMarkdown": "The `RemoteStreamAppenderClient` class in `logback-classic` and the `SocketNode` classes in `logback-classic` and `logback-access` allow data to be deserialized over a Java `Socket`, via an `ObjectInputStream`, without validating the data beforehand.  When data is received from the `Socket`, to be logged, it is deserialized into Java objects.  An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the `Socket`, which may result in execution of arbitrary code when those objects are deserialized.\n\nNote that although `logback-core` is implicated by the Logback project [here](https://jira.qos.ch/browse/LOGBACK-1254), the Sonatype Security Research team discovered that the vulnerability is actually present in the `logback-classic` and `logback-access` components.\n\n*Advisory Deviation Notice*: The Sonatype Security Research team discovered that this vulnerability was first introduced in version 0.3.0 of `logback-classic` and version 0.6.0 of `logback-access`, as opposed to being present in *all* versions prior to 1.2.0, as stated in [the advisory](https://nvd.nist.gov/vuln/detail/CVE-2017-5929).",
    "detectionMarkdown": null,
    "recommendationMarkdown": null,
    "advisories": null,
    "researchType": "DEEP_DIVE",
    "isAdvancedVulnerabilityDetection": false,
    "detectionType": null
}

Vulnerability Details with EPSS Score

The Vulnerability Details REST API response includes the EPSS (Exploit Prediction Scoring System) score.

The value of epssData in the JSON response indicates the probability of exploitation of the vulnerability in the next 30 days. When considered in the context of the CVSS scores, EPSS scores provide a good risk estimation and can help prioritizing the remediation.

EPSS Score	CVSS Score	Priority
Low	Low	Low, exploitation unlikely
Low	High	High impact but exploitation unlikely
High (>0.5)	Moderate or High	Critical, exploitation most likely

Sample Response with EPSS score

The epssData section in the JSON response below contains the value for currentScore as 0.00278.

Interpretation: The probability of exploitation of the vulnerability CVE-2022-42003 over the next 30 days (from the date of publication) is 0.00278.

NOTE: The EPSS scores are probabilistic and are updated on a daily basis.

{
    "identifier": "CVE-2022-42003",
    "vulnIds": ["CVE-2022-42003"],
    "vulnerabilityLink": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-42003",
    "source": {
        "shortName": "CVE",
        "longName": "National Vulnerability Database"
    },
    "mainSeverity": {
        "source": "cve_cvss_3",
        "sourceLabel": "CVE CVSS 3",
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    },
    "severityScores": [
        {"source": "sonatype_cvss_3", "sourceLabel": "Sonatype CVSS 3", "score": 5.9}
    ],
    "weakness": {"cweSource": "CVE", "cweIds": [{"id": "502", "uri": "https://cwe.mitre.org/data/definitions/502.html"}]},
    "categories": ["configuration", "data"],
    "description": "In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.",
    "explanationMarkdown": "The `jackson-databind` package is vulnerable to Denial of Service (DoS) attacks. The methods listed below in the `StdDeserializer` class fail to properly detect deeply-nested arrays in primitive value de-serializers, which might allow malicious actors to exhaust system resources. An attacker can exploit this vulnerability by supplying an affected instance with specially-crafted data to cause a DoS condition.\n\n*Vulnerable Method(s)*:\n\ncom/fasterxml/jackson/databind/deser/std/StdDeserializer.class\n- _deserializeWrappedValue()\n- _parseBooleanPrimitive()\n- _parseBytePrimitive()\n- _parseShortPrimitive()\n- _parseIntPrimitive()\n- _parseLongPrimitive()\n- _parseFloatPrimitive()\n- _parseDoublePrimitive()\n- _parseDateFromArray()",
    "componentExplanationMarkdown": "",
    "detectionMarkdown": "The application is vulnerable by using this component and enabling the `UNWRAP_SINGLE_VALUE_ARRAYS` feature.",
    "componentDetectionMarkdown": "",
    "recommendationMarkdown": "We recommend upgrading to a version of this component that is not vulnerable to this specific issue.\n\nNote: If this component is included as a bundled/transitive dependency of another component, there may not be an upgrade path. In this instance, we recommend contacting the maintainers who included the vulnerable package. Alternatively, we recommend investigating alternative components or a potential mitigating control.",
    "componentRecommendationMarkdown": "",
    "rootCauses": [{"listOfPaths": ["jackson-databind-2.4.1.jar", "com/fasterxml/jackson/databind/deser/std/EnumDeserializer.class"], "versionRange": "[2.4.0-rc1, 2.8.8)"}],
    "advisories": [{"referenceType": "PROJECT", "url": "https://github.com/FasterXML/jackson-databind/issues/3590"}, {"referenceType": "THIRD_PARTY", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020"}],
    "vulnerableVersionRanges": ["[2.4.0-rc1,2.8.8)"],
    "researchType": "DEEP_DIVE",
    "isAdvancedVulnerabilityDetection": false,
    "detectionType": "PRIMARY",
    "kevData": {"isKev": false}
}

Bulk Vulnerability Details

Retrieve details for multiple CVE/Sonatype vulnerability IDs in one call via POST /api/v2/vulnerabilities. Each result uses the same schema as GET /api/v2/vulnerabilities/{vulnerabilityId}. See the single-lookup section for field definitions and examples.

Endpoint

POST /api/v2/vulnerabilities
Content-Type: application/json

Authentication and permissions

Authenticated: returns the full record (e.g., rootCauses, vulnerableVersionRanges, detection/recommendation markdown, etc.).
Anonymous: returns a limited subset of fields, same as the single-lookup API.

Request body

A JSON array of 1 - 1000 vulnerability identifiers (CVE or Sonatype vulnerability IDs).

Example:

["CVE-2024-23085", "CVE-2017-7525"]

Response

200 OK

{
    "vulnerabilities": {
    "CVE-2024-23085": {"...": "Same schema as GET /api/v2/vulnerabilities/{id}, including kevData and epssData when present"},
    "CVE-2017-7525": {"...": "Same schema as above"}
  }
}

Unknown or invalid identifiers are included in the vulnerabilities map as objects with all fields set to null and isAdvancedVulnerabilityDetection set to false. This ensures that the response always preserves the keys from the request, allowing clients to handle unresolved identifiers during post-processing.

400 Bad Request

Returned when the body is missing, not a JSON array, or the array contains no valid identifiers.

Example message:

No valid vulnerability identifiers provided

Examples

Authenticated bulk lookup

curl -u admin:admin123 \
    -H 'Content-Type: application/json' \
    -d '["CVE-2024-23085","CVE-2017-7525"]' \
    http://localhost:8070/api/v2/vulnerabilities

Anonymous bulk lookup (limited fields)

curl -H 'Content-Type: application/json' \
    -d '["CVE-2017-5929"]' \
    http://localhost:8070/api/v2/vulnerabilities

Mixed valid/invalid identifiers

curl -u admin:admin123 \
    -H 'Content-Type: application/json' \
    -d '["CVE-2024-23085","Wekjqwlwkerjkqw"]' \
    http://localhost:8070/api/v2/vulnerabilities

Response (abridged):

{
  "vulnerabilities": {
    "CVE-2024-23085": { "... full record ..."},
    "Wekjqwlwkerjkqw": {
      "identifier": null,
      "source": null,
      "mainSeverity": null,
      "severityScores": null,
      "weakness": null,
      "categories": null,
      "description": null,
      "explanationMarkdown": null,
      "detectionMarkdown": null,
      "recommendationMarkdown": null,
      "advisories": null,
      "researchType": null,
      "isAdvancedVulnerabilityDetection": false,
      "detectionType": null,
      "kevData": null,
      "epssData": null,
      "identificationSource": null
      }
   }
}

Empty array

curl -u admin:admin123 \
-H 'Content-Type: application/json' \
-d '[]' \
http://localhost:8070/api/v2/vulnerabilities

Response:

400 Bad Request
No valid vulnerability identifiers provided

Search results

No results found