Content Vulnerability Dashboard - User Guide

Overview

The Security Vulnerability Dashboard is a centralized platform that helps you track, monitor, and manage security vulnerabilities across Bloomreach CMS versions. It automatically collects vulnerability data from OWASP Dependency-Check scans and enriches it with remediation status from Jira tickets.

Why Does This Matter?

Security vulnerabilities in software dependencies can expose your systems to attacks. This dashboard helps you:

• Stay informed about known vulnerabilities affecting your CMS version

• Prioritize fixes by seeing severity levels (Critical, High, Medium, Low)

• Track remediation progress through linked Jira tickets

• Make informed decisions about upgrades and patches

How you benefits from this dashboard?

Benefit	How It Helps
Transparency	See vulnerabilities reported across the latest supported CMS release branches
Risk Assessment	Understand severity levels to prioritize your security efforts
Fix Timelines	View target fix versions
Self-Service	Check vulnerability status anytime without waiting for support
Compliance Support	Export data for your own security audits and compliance reports

Getting Started

Accessing the Dashboard

1. Navigate to the dashboard

2. Enter your username and password provided by your administrator

3. You'll be directed to the appropriate dashboard

Dashboard Features

Dashboard View, after you select your version

When you log in, you'll see:

• Statistics Cards - Total vulnerabilities, Critical count, Open issues, Resolved count

• Filters - Version, Severity, Status, Dependency Type, Search

• Vulnerability Table - Paginated list with CVE ID, Title, Severity, Status, Version

Statistics Overview

The top of the dashboard shows key metrics at a glance:

Metric	Description
Total Vulnerabilities	All vulnerabilities across filtered results
Critical	Highest severity issues requiring immediate attention
Open	Vulnerabilities not yet resolved
Resolved	Issues that have been addressed (check Comments for details)

Filtering Vulnerabilities

Use filters to find exactly what you need:

Filter	Options	Use Case
Version	All supported releases	"Show me vulnerabilities in v16"
Severity	Critical, High, Medium, Low	"Show only Critical and High issues"
Status	Open, In Progress, Resolved	"Show me what's still open"
Dependency Type	Production, Developer	"Show production dependencies only"
Search	Free text	Search by CVE ID, component name, or Jira ticket

Pro Tip: Filters can be combined. For example, filter by "v16 + Critical + Open" to see critical unresolved issues in version 16.

Viewing Vulnerability Details

Click any row in the table to see complete information:

• CVE Information - Official CVE ID, title, and description

• Affected Component - Which library/dependency is vulnerable

• Evidence - Links to CVE databases and security advisories

• Jira Ticket - Linked issue with status, fix version, and planned date

• References - Additional resources and documentation

Important: Always check the Comments section in the vulnerability detail view to understand whether a vulnerability is fixable or not. Comments contain critical context such as:

• Whether the vulnerability is exploitable in our specific usage

• If a fix is blocked by upstream dependencies

• Workarounds or mitigations available

• Reasons why a vulnerability may be marked as "Won't Fix"

Exporting Data

Click the Export CSV button to download the current filtered view. The export includes:

• CVE ID and title

• Severity and status

• CMS version

• Affected component

• Jira ticket (if linked)

Common Use Cases

Use Case 1: Customer asks if a CVE affects their installation

Scenario: "Does CVE-2024-1234 affect our v15 installation?"

Steps:

1. Log into the dashboard

2. Select v15 from the Version filter

3. Enter CVE-2024-1234 in the search box

4. If it appears, click to see full details and remediation status

5. If no results, the OWASP scanner has not flagged this CVE for v15 — this does not conclusively confirm the version is unaffected

Use Case 2: Generate a security report for critical production issues

Scenario: "I need a security report for all critical issues in production"

Steps:

1. Set filters:

   • Severity: Critical

   • Dependency Type: Production

2. Review the filtered list

3. Click Export CSV to download

4. Use the CSV for your report or audit

Use Case 3: Compare security posture across versions

Scenario: "What's the security posture of each CMS version?"

Steps:

1. For each version (v14, v15, v16, v17):

   • Select the version filter

   • Note the statistics (Total, Critical, Open, Resolved)

2. Compare to recommend the most secure version

Use Case 4: Check if a fix is coming

Scenario: "Is there a fix coming for this vulnerability?"

Steps:

1. Find the vulnerability in the list

2. Click to view details

3. Check the Jira Ticket section:

   • Status: Shows if work is in progress

   • Fix Version: Target release version

4. Check the Comments section in the dashboard - Comments contain important context about whether the vulnerability is fixable, any blockers, or alternative mitigations

Understanding Vulnerability Data

Severity Levels

Level	CVSS Score	Meaning
Critical	9.0 - 10.0	Immediate action required. Can be exploited remotely with severe impact.
High	7.0 - 8.9	High priority. Significant risk that should be addressed soon.
Medium	4.0 - 6.9	Moderate risk. Plan to address in regular maintenance.
Low	0.1 - 3.9	Minor risk. Address when convenient.

Status Meanings

Status	What It Means
Open	Vulnerability identified but not yet being worked on
In Progress	A fix is actively being developed
Resolved	Vulnerability has been addressed (see note below)
N/A	No Jira ticket has been linked to this vulnerability. The vulnerability was detected by the OWASP scanner but has not yet been triaged or tracked in Jira. The Jira Ticket, Status, and Fix Version columns will all show N/A for these entries.

Important: A "Resolved" status does not always mean the vulnerability has been fixed with a code change. The Jira ticket's Resolution field provides the actual reason. Common Jira resolutions include:

• Fixed - A code fix was applied and tested

• Won't Fix - The risk has been assessed and the issue will not be fixed (e.g., the affected version is EOL or no longer supported, so risk is accepted)

• Won't Do - The issue won't be actioned

• Invalid - The vulnerability is a false positive or doesn't apply to our usage

• Duplicate - The issue is already tracked by another ticket

• Cannot Reproduce - The vulnerability could not be reproduced or verified

• Outdated - The issue refers to a deprecated component or version

• Probably fixed, check next version - Likely fixed by an upstream release

Always check the Comments section in the vulnerability detail view for the actual resolution reason.

Dependency Types

Type	Meaning
Production	Used in runtime - affects deployed applications
Development	Used only internally in bloomreach - No risk

OWASP Dependency-Check

• Automatically scans CMS dependencies

• Identifies known CVEs in libraries

• Runs on each CMS version branch

• Updated regularly via Jenkins jobs

Frequently Asked Questions

How often is the data updated?

The data is refreshed when an admin clicks the "Refresh" button. This pulls the latest OWASP scan results from Jenkins and current ticket status from Jira.

Why do I see the same CVE multiple times?

A vulnerability may appear for each CMS version it affects. Filter by a specific version to see deduplicated results.

Can I get notified about new critical vulnerabilities?

Currently, the dashboard is pull-based (you check it). 

Who do I contact for access?

Contact your Account Manager or the Bloomreach support team to request dashboard credentials.

How do I know if a vulnerability is fixable?

Check the Comments section in the vulnerability detail view. The comments provide crucial context including:

• Engineering assessments on fixability

• Dependencies on upstream library releases

• Whether the vulnerability applies to our specific usage

• Workarounds or configuration changes that mitigate the risk

• Explanations for "Won't Fix" decisions

Does "Resolved" mean the vulnerability is fixed?

Not always. A "Resolved" status indicates the vulnerability has been addressed, but check the linked Jira ticket and its comments to understand the actual outcome. Common resolution states include:

• Fixed - A code fix was applied

• Won't Fix - The risk was assessed and the team decided not to fix it (typically when the affected version is EOL / no longer supported)

• Won't Do - The issue won't be actioned

• Invalid - The vulnerability was determined to be a false positive or not applicable to our context

• Duplicate - The issue is already tracked by another ticket

• Cannot Reproduce - The vulnerability could not be reproduced

• Outdated - The issue refers to a deprecated component or version

• Probably fixed, check next version - Likely fixed by an upstream release

A Jira ticket may be created to track the investigation and then closed once the assessment is complete. Always check the Comments section in the dashboard to understand the actual resolution.

The vulnerability details don't load - what do I do?

1. Check your network connection

2. Try refreshing the page

3. Clear your browser cache

4. Contact support if the issue persists

What does N/A mean in the Jira Ticket, Status, or Fix Version columns?

N/A means no Jira ticket has been linked to that vulnerability yet. The OWASP scanner detected the CVE, but it has not yet been triaged or assigned a tracking ticket in Jira. Until a ticket is linked, the Jira Ticket, Status, and Fix Version columns will all display N/A.

Report an Issue or Suggestion

If you need help with the dashboard or have questions about vulnerabilities:

• Vulnerability Questions: Reach out to the Bloomreach Support team.

• Feature Requests: Submit through your account manager