ISismalicious
cve

Resolve an external identifier to its CVEs

Changed on

What an id from another database names in the catalogue, as a LIST: a GHSA advisory can cover several CVEs, a bundle advisory (USN, RHSA, ALSA, DSA, SUSE-SU…) fixes several. Each match carries its relation (alias: the same flaw; bundle: an advisory that fixes it with others; exploit-module, exploit-reference; embedded: the id spells the CVE id out), the sources that assert it, the id's own url and the licenses the asserting records carry. A CVE id answers itself. At most 50 matches, aliases first, then newest first; count is every CVE the id names and truncated says when matches lists fewer (an ALSA can fix 323). GET /cve/{id} and GET /cve?id= accept the same ids and answer with the document when an id names exactly one CVE. Every answer carries Link: <https://api.ismalicious.com/cve/attribution>; rel="license". Costs one request of the monthly quota.

get/cve/resolve

Request

  • Base URL
    https://api.ismalicious.com
  • Auth
    • API key in header X-API-KEY
    • or HTTP bearer
    • or HTTP basic

Query parameters

idstring

An external identifier — GHSA, PYSEC, GO, RUSTSEC, PSF, EEF, JLSEC, BIT, DRUPAL, MAL, OSV, GSD, ASB/PUB, AZL, CGA, MINI, EUVD, GCVE; a bundle advisory (USN, LSN, RHSA/RHBA/RHEA, ALSA/ALBA/ALEA, RLSA/RLBA/RXSA, DSA/DLA/DTSA, SUSE-SU, openSUSE-SU, MGASA, OESA, CLSA, ELSA, ALAS); exploit material (EDB-n, ZDI-yy-nnn, MSyy-nnn, a Metasploit module path); an id spelling a CVE out (UBUNTU-CVE-…, GCVE-0-…); or a CVE id. Case-insensitive.

Response

{id, scheme, count, truncated, matches[{cveId, scheme, externalId, relation, sources[], url, licenses[]}]}: count is every CVE the id names, matches the first 50 of them (truncated when there are more)

object required

Changes