Filter tool

Vulnerabilities (CVE) results

Is a fix available from the vendor?
Is the container exposed to the Internet?
Are ingress ports open?
Is the container privileged?
Is an exploit available?

The data for each CVE ID that consists of the highest risk score, highest CVE risk factors, highest environmental risk factors, highest severity, and highest CVSS for all impacted packages display the highest value for the CVE based on your entire environment. This is irrespective of the applied filters, collections, or accounts that you are assigned to.
The vulnerability (CVE) results hide the
impacted resources
if you use a filter or have an assigned collection or account as the percentage refers to the entire environment. This is supported for the System Admin role only.
The exported CSV displays an empty column of
impacted resources
if you use a filter or have an assigned collection or account as this percentage refers to the entire environment.
If a filter returns more than 100 results, only the top 100 results are shown. You can download the full data in a CSV format.
You cannot combine the filters
CVSS threshold
and
Severity threshold
with
Collections
. Also, filtering by
CVSS threshold
and
Severity threshold
is not supported for users with assigned collections or accounts.
The vulnerability (CVE) results display vulnerabilities based on a set filter threshold or higher.

CVE ID details

The vulnerability explorer CVE dialog appears when you click on a row in the Vulnerabilities (CVE) results.

The vulnerability explorer CVE dialog displays the following:

CVE description and its impacted packages.
A list of all impacted resources such as deployed images, registry images, hosts, and functions filtered based on the severity threshold, CVSS threshold, or collections if specified in the
Filter tool
of the vulnerability explorer.
The highest risk profile for a CVE ID based on the highest risk in an environment.
For each resource type, the highest risk profile includes the risk score and risk factors found in the entire environment and is regardless of the filters and assigned collections or accounts.

In the risk profile section, you can see the percentage of the impacted resources along with the risk score.

+ The

impacted resources percentage

is not displayed if you use a filter or have assigned collections or accounts as it reflects the value based on the entire environment.

You can export a list of impacted resources in a CSV format from here or from the

Actions

column as described earlier.

For each impacted resource, you can hover over the

Vulnerability

tag next to the resource name to see the specific package, severity, and CVSS of the CVE for a resource.

Image details

The image details also show the Start time when the image was first deployed within the container.

Also, you can see the time duration that has elapsed since the deployment. This helps in determining how long a vulnerable image has been running.

In

Prisma Cloud Compute > Manage > System > Scan > Scan settings > Running images

, when the option

Only scan images with running containers

is turned off, the image details show the Start time when the Defender first reads the image. This is applicable for all images (deployed and not deployed).

Risk factors

{Critical | High | Medium} severity
 — Vulnerability severity.
Has fix
 — Fix is available from the distro, vendor, or package maintainer.
Remote execution
 — Vulnerability can be exploited to run arbitrary code.
DoS {High/Low}
 — Component is vulnerable to denial of service attacks, such as buffer overflow attacks, and ICMP floods. The risk is categorized as high or low based on impact.
Recent vulnerability
 — Vulnerability was reported in the current or previous year.
Exploit PoC
 — Code and procedures to exploit the vulnerability are publicly available.
Exploit in the wild
 — Exploit attempts of this vulnerability that have been seen in the wild. All vulnerabilities are from the CISA KEV Catalog.
Attack complexity: low
 — Vulnerability is easily exploited.
Attack vector: network
 — Vulnerability is remotely exploitable. The vulnerable component is bound to the network, and the attacker’s path is through the network.
Reachable from the internet
 — Vulnerability exists in a container exposed to the internet. The detection of this risk factor requires that CNNS will be enabled and network objects will be defined for external sources under
Radar > Settings
. Then, if a connection is established between the defined external source and the container, the container is identified as reachable from the internet.
Listening ports
 — Vulnerability exists in a container that is listening on network ports.
Container is running as root
 — Vulnerability exists in a container running with elevated privileges.
No mandatory security profile applied
 — Vulnerability exists in a container running with no security profile.
Running as privileged container
 — Vulnerability exists in a container running with --privileged flag.
Sensitive information
 — Vulnerability exists in a container or a serverless function that stores private keys or has environment variables that provide sensitive information.
Root Mount
 — Vulnerability exists in a container with access to the host filesystem.
Runtime socket
 — Vulnerability exists in a container with access to the host container runtime socket.
Host Access
 — Vulnerability exists in a container with access to the host namespace, network, or devices.
Package in use
 — Vulnerability exists in a component that is actually running. For example, if Redis is running in a container or on a host as a service, then all the following (hypothetical) vulnerabilities could be surfaced by filtering on this risk factor:
redis (main process) CVE-XXX, CVE-XXX
|- libssl (dependent package) CVE-XXX, CVE-XXX
|- libzip (dependent package) CVE-XXX, CVE-XXX
The 'package in use' risk factor is only supported for Java JARs
For more details, see scan reports.

Risk trees

Recalculating statistics