Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_vex",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A Nuclei v3.8.0 scan of the nvulnlookup vl-web binary v0.1.31 against https://localhost:8080 produced nine medium-severity findings. Exactly one (CVE-2023-0057, missing clickjacking protection) is a genuine hardening gap and is fixed in this advisory by installing a baseline security-headers middleware on every outgoing response. The other eight findings are confirmed false positives: the Nuclei templates match on generic HTTP response shapes (404, 405, 200 without a specific product banner) that coincide with unrelated product vulnerabilities we do not run. This advisory documents both the remediation and the per-finding false-positive disposition so operators can reconcile their own Nuclei reports.",
"title": "Summary"
},
{
"category": "description",
"text": "Nuclei templates are string-matching probes against HTTP responses. When run against a server that is NOT the scanned product, the template will still fire if the response shape happens to match the detection signature (e.g., a 404 body that does not contain a specific string, a 200 body without a specific header). This advisory catalogs the nine findings from the 2026-04-22T17-25-55Z scan of vl-web v0.1.31:\n\nReal (fixed): CVE-2023-0057 (clickjacking — missing X-Frame-Options and Content-Security-Policy frame-ancestors directives).\n\nFalse positives (product mismatch or signature artefact):\n * CVE-2021-44155 — Reprise License Manager user enumeration. vl-web returned 404 to /goform/login_process because that endpoint does not exist; template fired on the 404 body not containing 'Login Failed'. vl-web is not Reprise License Manager.\n * CVE-2020-11453 — MicroStrategy Web 10.4 SSRF. vl-web returned 404 to /MicroStrategyWS/ because that endpoint does not exist. vl-web is not MicroStrategy.\n * CVE-2021-22939 — Node.js HTTPS rejectUnauthorized handling. vl-web is a Rust (hyper + rustls) binary, not Node.js. Template fired on a 200 OK response shape.\n * CVE-2023-0055 — missing `Secure` attribute on Set-Cookie over HTTPS. vl-web does not set any cookies on GET / and does not issue Set-Cookie headers. Template fired on the absence of the attribute in the absence of the header.\n * ASVS-4-0-3-V13-2-2 — JSON schema validation. vl-web rejects unknown POST targets at `/` with 405 Method Not Allowed. The handler-less root does not read a JSON body, so schema validation is vacuous at that endpoint; JSON-bearing API routes under /api/v1/ DO validate schemas via serde's #[serde(deny_unknown_fields)] contract.\n * ASVS-4-0-3-V13-3-1 — XSD (XML Schema) validation. vl-web does not accept XML input anywhere; every content-type handler is JSON, form-urlencoded, or empty. Template fired on a 405 response to an XML POST.\n * ASVS-4-0-3-V13-2-3 — Access Restriction Bypass via Origin spoof (CSRF). vl-web is a read-only public vulnerability aggregator; the GET / surface is cookie-less and has no authenticated session to hijack. The POST / PATCH / DELETE surface IS protected by API-key middleware (see ndaal-sa-2026-017 for the related design discussion).\n * some-PIIs — a generic template whose extracted-match field is empty ('- ') in the report. No PII regex matched; template produced a finding on the bare fact that a 200 OK was returned.",
"title": "Vulnerability Description"
},
{
"category": "general",
"text": "vl-web is the HTTP front-end of the nvulnlookup vulnerability aggregator. It is explicitly designed as a read-mostly public service: anonymous clients can browse CVE records, Debian tracker entries, CNA scorecards, and KEV enrichment. The POST / PATCH / DELETE surface (annotations, sightings, KEV upload, operator actions) is gated by API-key middleware. Cookies are not used for session state anywhere in v0.1.x. The security posture for public-read endpoints therefore focuses on defence-in-depth for browser-based clients: HTTPS enforcement (HSTS), clickjacking protection (X-Frame-Options + CSP frame-ancestors), MIME-sniffing lock-down (X-Content-Type-Options), referrer minimisation (Referrer-Policy), and permission-surface reduction (Permissions-Policy).",
"title": "Context"
},
{
"category": "other",
"text": "Disposition: ONE finding is fixed (CVE-2023-0057); EIGHT findings are known_not_affected (confirmed false positives per the reasoning above). Operators running the same Nuclei template set against v0.1.32-or-later binaries should see CVE-2023-0057 disappear; the other eight will continue to fire until the upstream ProjectDiscovery templates add a product fingerprint check.",
"title": "Disposition"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/018/ndaal-sa-2026-018.json"
},
{
"category": "external",
"summary": "Nuclei DAST artefacts from the 2026-04-22 run that produced these findings",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/tree/main/documentation/vulnerabilities/nuclei/2026-04-22T17-25-55Z"
},
{
"category": "external",
"summary": "vl-web source — router pipeline where the security headers are injected",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/vulnerability-lookup-rs/crates/vl-web/src/router.rs"
},
{
"category": "external",
"summary": "OWASP Secure Headers Project — rationale for the X-Frame-Options / CSP / HSTS / etc. bundle",
"url": "https://owasp.org/www-project-secure-headers/"
},
{
"category": "external",
"summary": "MDN reference — Content-Security-Policy frame-ancestors",
"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors"
},
{
"category": "external",
"summary": "Related advisory — /api/v1 unauthenticated-read is by design",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/017/ndaal-sa-2026-017.json"
}
],
"title": "ndaal Security Advisory: vl-web Nuclei scan 2026-04-22 — clickjacking header gap fixed; 8 findings confirmed false positives",
"tracking": {
"current_release_date": "2026-04-22T18:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-018",
"initial_release_date": "2026-04-22T18:00:00.000Z",
"revision_history": [
{
"date": "2026-04-22T18:00:00.000Z",
"number": "1.0.0",
"summary": "Initial advisory: install baseline security-headers middleware (fixes CVE-2023-0057); document per-finding false-positive disposition for the other eight Nuclei findings from the 2026-04-22T17-25-55Z scan."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "nvulnlookup",
"branches": [
{
"category": "product_version",
"name": "0.1.31",
"product": {
"name": "nvulnlookup vl-web 0.1.31 — pre-security-headers",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.1.31-sec-hdrs",
"product": {
"name": "nvulnlookup vl-web 0.1.31 with the router-level security-headers middleware (this advisory's fix)",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-0057",
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#clickjacking"
},
{
"system_name": "nuclei-template",
"text": "clickjacking-check (pyload/pyload signature, fires on absence of X-Frame-Options)"
}
],
"notes": [
{
"category": "description",
"text": "vl-web v0.1.31 served every HTML response (including the home dashboard at /) without an X-Frame-Options header and without a Content-Security-Policy frame-ancestors directive. A malicious page could therefore iframe the dashboard and trick an authenticated admin into clicking UI elements (the dashboard's stats / CNA-scorecard / annotation links) by overlaying deceptive chrome. The Nuclei 'clickjacking-check' template matched against pyload/pyload signatures but the underlying risk is generic — any HTML response without frame controls is clickjacking-susceptible.",
"title": "Technical Description"
},
{
"category": "details",
"text": "Fix: every response emitted by Router::handle_parts() now flows through apply_security_headers(), which injects a comprehensive baseline: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Strict-Transport-Security: max-age=63072000; includeSubDomains; preload, Referrer-Policy: no-referrer, Content-Security-Policy (including frame-ancestors 'none', base-uri 'none', form-action 'self', object-src 'none'), Permissions-Policy (deny camera/mic/geolocation/payment/usb/interest-cohort), Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy: same-origin, Cross-Origin-Embedder-Policy: require-corp. This is defence-in-depth — X-Frame-Options is the legacy header that pre-CSP browsers honour, frame-ancestors is the CSP3 directive that modern browsers honour.",
"title": "Remediation Detail"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to vl-web 0.1.31 with the security-headers middleware (or to v0.1.32-or-later once tagged). The fix is a single ~60-line function in crates/vl-web/src/router.rs that runs unconditionally at the tail of handle_parts(); no configuration is required.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/commit/HEAD",
"date": "2026-04-22T18:00:00.000Z"
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "Missing X-Frame-Options and Content-Security-Policy frame-ancestors headers allow clickjacking (CVE-2023-0057)"
},
{
"cve": "CVE-2021-44155",
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#fp-reprise"
}
],
"notes": [
{
"category": "description",
"text": "Nuclei POSTed to https://localhost:8080/goform/login_process and received HTTP 404 'Not Found' (the endpoint does not exist in vl-web). The template's detection is 'the body does not contain Login Failed' — trivially true for our 9-byte 'Not Found' body. vl-web is not Reprise License Manager; the 404 is the router's default no-match response applied uniformly to every unknown path."
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "Nuclei false-positive: Reprise License Manager 14.2 user enumeration (CVE-2021-44155)",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2020-11453",
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#fp-microstrategy"
}
],
"notes": [
{
"category": "description",
"text": "Nuclei GET /MicroStrategyWS/ returned HTTP 404 'Not Found'. vl-web is not MicroStrategy Web and does not ship the /MicroStrategyWS/ endpoint. The 404 is the router's default."
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "Nuclei false-positive: MicroStrategy Web 10.4 SSRF (CVE-2020-11453)",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2021-22939",
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#fp-nodejs"
}
],
"notes": [
{
"category": "description",
"text": "vl-web is a Rust binary built on hyper + rustls, not Node.js. The Nuclei template fired on the bare fact that a 200 OK HTML response was returned for GET /. No Node.js runtime is present; CVE-2021-22939 is a Node core bug that cannot apply to a process that does not link the Node HTTPS library."
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "Nuclei false-positive: Node.js HTTPS rejectUnauthorized undefined handling (CVE-2021-22939)",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2023-0055",
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#fp-set-cookie"
}
],
"notes": [
{
"category": "description",
"text": "vl-web does not set any cookies on GET /; the response carries no Set-Cookie header at all. The template's matcher ('Set-Cookie without Secure') fired on the absence of the attribute in a header that does not exist. v0.1.x has no cookie-based session state anywhere in the codebase."
},
{
"category": "details",
"text": "If a future release ever needs cookies, the response-header middleware added by this advisory is the single chokepoint and will enforce Secure; HttpOnly; SameSite=Strict at that time."
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "Nuclei false-positive: Missing Secure attribute on Set-Cookie over HTTPS (CVE-2023-0055)",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#fp-asvs-13-2-2"
},
{
"system_name": "asvs",
"text": "ASVS-4-0-3-V13-2-2"
}
],
"notes": [
{
"category": "description",
"text": "Nuclei POSTed a JSON body to https://localhost:8080/ (the dashboard root, GET-only) and received HTTP 405 Method Not Allowed. The template expected either a 200 ok with the body echoed back or a schema-validation error body; the 405 response fooled the matcher. JSON-bearing API routes under /api/v1/ validate their inputs via serde's strict-field deserialisation; every request handler that reads a JSON body uses #[serde(deny_unknown_fields)] on the struct."
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "Nuclei false-positive: ASVS V13.2.2 — JSON schema validation does not take place",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#fp-asvs-13-3-1"
},
{
"system_name": "asvs",
"text": "ASVS-4-0-3-V13-3-1"
}
],
"notes": [
{
"category": "description",
"text": "Nuclei POSTed an XML body to https://localhost:8080/. vl-web has no XML content-type handler anywhere in the code base — every endpoint consumes JSON or application/x-www-form-urlencoded. The server returned 405 Method Not Allowed; the template interpreted that as 'no schema validation'. XSD validation is not applicable because there is no XML input surface to validate."
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "Nuclei false-positive: ASVS V13.3.1 — XSD schema validation does not take place",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#fp-asvs-13-2-3"
},
{
"system_name": "asvs",
"text": "ASVS-4-0-3-V13-2-3"
}
],
"notes": [
{
"category": "description",
"text": "vl-web is a read-only public vulnerability aggregator. GET endpoints carry no cookies and no authenticated session state — an attacker who successfully spoofs the Origin header still retrieves the same anonymous data any user could retrieve directly. The POST / PATCH / DELETE surface (annotations, sightings, KEV upload, operator routes) IS gated by the API-key middleware documented in ndaal-sa-2026-017, which takes the key from the X-API-Key header rather than from a cookie — Origin spoofing does not bypass that check. The Nuclei template fired because the GET / response lacks an Origin-validating 403, which is correct behaviour for an unauthenticated public read."
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "Nuclei false-positive: ASVS V13.2.3 — Access restriction bypass via Origin spoof",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"ids": [
{
"system_name": "ndaal",
"text": "ndaal-sa-2026-018#fp-some-piis"
}
],
"notes": [
{
"category": "description",
"text": "The Nuclei template 'some-PIIs' (author: ax01sec) reports 'Extracted results: - ' — an empty match string, i.e. no PII regex actually matched. The template emits a finding on every 200 OK HTML response regardless of whether any PII-shaped string was extracted. The dashboard's served HTML is Bootstrap chrome, Askama-rendered vulnerability metadata, and public CVE / advisory data — none of which contains PII. This is a known-noisy template; upstream ProjectDiscovery has not quality-gated it."
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "Nuclei false-positive: some-PIIs (empty-match PII template)",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
}
]
}