Skip to content
DeviceQuest DeviceQuest DeviceQuest Docs User Documentation

Documentation

CVE details

See everything about one CVE, which of your assets it affects, and the remediations and exceptions linked to it.

Overview

The CVE details page shows one CVE from the catalogue: its scores, description, affected and fixed versions, and references, together with the assets in your estate that it affects. From here you triage the affected assets, create a remediation ticket and request exceptions.

Open it by clicking a CVE ID on the Vulnerabilities page, from a triage card, or from a link elsewhere in DeviceQuest. You can also go straight to a CVE by its ID, for example /vulnerabilities/CVE-2017-5638.

You need vulnerabilities:read to open the page. Triage actions need vulnerabilities:write, creating tickets and remediations needs remediation:write, requesting an exception needs exceptions:request, and overriding severity needs admin:manage.

Screen tour

  1. ← Back to vulnerabilities: returns to the catalogue.
  2. The CVE ID, its severity, the CVSSv3 and CVSSv4 scores, the EPSS probability and, for known exploited CVEs, the CISA KEV badge. Below them are the Published and Modified dates.
  3. View affected assets →: opens Triage filtered to this CVE.
  4. Create Ticket: creates a remediation ticket for this CVE. See Create a ticket.
  5. The CVSS score and, when the feed provides a CVSS vector, a chart of its metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity and Availability.
  6. The tabs: Overview, Affected Assets, Remediations and Exceptions. A badge shows how many items each tab holds.
  7. ⌘K: opens the command palette for this page.

Use the ← and → arrow keys to move between tabs. The open tab is kept in the page address, so a link can open a specific tab.

Overview tab

SectionWhat it shows
DescriptionThe CVE description from the feed.
Exploit Prediction & CISA KEVEPSS Score, EPSS Percentile, and the CISA KEV badge with CISA Known Exploited Vulnerability when the CVE is in the KEV catalogue.
CVSS BreakdownThe full CVSS chart with the Base Score, when the feed provides a CVSS vector.
Affected SoftwareThe products the CVE applies to.
Affected VersionsThe vulnerable version ranges, for example < 2.3.32.
Fixed VersionsThe versions that fix the CVE, for example >= 2.3.32.
ReferencesLinks to advisories and write-ups. They open in a new tab.

Affected Assets tab

  1. Select assets with the checkboxes, or select them all from the header checkbox.
  2. Asset: the asset’s hostname, IP address, serial number or cloud ARN. Click it to open the asset.
  3. Status: the triage status of this CVE on this asset: Open, In progress, Resolved, Dismissed or Accepted risk.
  4. Severity and Override: the feed severity, and the severity an administrator recorded for this asset, if any.
  5. SLA: days since the CVE was first seen on the asset.
  6. Actions: the triage actions for this asset.

The tab lists every asset in your estate that this CVE matches, with N asset(s) affected above the table. The other columns show who acknowledged the match (Acknowledged by), when the match was created (Created), and when the vulnerable software was first and last seen on the asset (First Seen, Last Seen).

SLA chip

The SLA chip counts the days since the CVE was first seen on the asset, against a 30-day SLA:

ChipDays since first seenMeaning
Green, for example 12d0–20Within SLA
Amber, for example 25d21–30Approaching the SLA
Red, for example 41dmore than 30Past the SLA

Hover the chip to see, for example, 25 days since first seen (SLA: 30 days).

Bulk actions

Select one or more assets to show the bulk bar with N selected and three buttons:

ButtonWhat it does
Accept RiskOpens Request exception for the selected matches with Why now? set to Accepted business risk. The matches become Accepted risk once an approver approves the exception.
False PositiveCloses the selected matches as dismissed with the reason False positive, so the audit trail shows why.
RemediateMarks the selected matches as Resolved, recording who resolved them and when.

Each change is recorded in the audit log.

Row actions

Hover a row to show its actions. They work exactly as in Triage:

  • Acknowledge: moves an open match to In progress.
  • Assign: assigns the match to a user by email or user ID.
  • Dismiss: closes the match with a reason of at least 3 characters.
  • Resolve: marks the match as resolved, after you confirm.
  • More actions (⋯):
    • Override severity (administrators): records a different severity for this asset. See Override severity.
    • Create remediation: opens the Create remediation dialog with this CVE and asset filled in.
    • Request exception: opens the Request exception dialog for this match. See Request an exception.

Remediations tab

The Remediations tab lists the remediation tasks for this CVE, most urgent priority first. Each card shows the title, priority, status, description, asset and creation date. Click a card to open the remediation.

To add one, click Create remediation:

  1. CVE: this CVE, filled in for you.
  2. Asset: optional. Search for the asset the task is for.
  3. Title: required, for example “Patch nginx to 1.27”.
  4. Description: optional steps, ticket links and context.
  5. Due date: the target date for the fix.
  6. Priority: critical, high, medium (the default) or low.

Click Create. The task appears on the tab and on the Remediations page.

Exceptions tab

The Exceptions tab lists the risk-acceptance exceptions requested for this CVE on any of your assets. Each card shows:

  • the justification, in quotes,
  • who requested or decided it, and when,
  • the status, for example requested or approved,
  • an expiry bar with the time left, for example 45 days left, expires today or 3d overdue,
  • View exception →, which opens the exception.

To request an exception, open the Affected Assets tab, click More actions on the asset’s row, and choose Request exception.

Create a ticket

Click Create Ticket in the header. DeviceQuest creates a remediation task straight away:

  • Title: Remediate {CVE ID}, for example Remediate CVE-2017-5638
  • Priority: medium
  • Status: open

The button changes to Ticket created: followed by the ticket title. Click the title to open the new task on its remediation page (/remediations/{id}), where you assign it, set its priority and add details.

Command palette

Press ⌘K (or Ctrl+K), or click ⌘K, to jump to Go to Overview, Affected Assets (n), Remediations (n) or Exceptions (n), or to Open in triage.

Keyboard shortcuts

KeyAction
← / →Previous / next tab
⌘K / Ctrl+KOpen the command palette
EscClose the palette