In the Prisma i can see vulnerabilities pointing on files that are not there anymore

[AKhalpakhchyan]

Hello everyone,

In the Prisma compliance check, I see some vulnerabilities that seem outdated.

For example, Prisma reports a vulnerable file that does not exist and, most likely, it's not there for a while.

Is it a bug, or I'm missing something?

-Andrey

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[musiddiqui]

Hi Andrey,

 I hope you are doing well. I went through the screenshots you attached. Can you look for the "org.codehaus.plex
us dexus-unis" package in the package info tab and let me know what are you seeing?

Regards,

[AKhalpakhchyan]

Hello Muhammad,

Thanks a lot for your reply!

I can't find the dexus-unis in the packages list. I took screenshots of "org.codehaus.plexus".

It has 9 available components.

-Andrey

[musiddiqui]

Hi Andrey,

Thank you for providing the screenshots. According to it, you are currently using version 1.5.15 of "org.codehaus.plexus_plexus-utils". Since the type of this vulnerability is "jar", you will not be able to locate it on the host. You need to update the pom.xml file for the Plexus package to update it. You have to use at least the 3.0.16 version to avoid this vulnerability and remove the old versions. I hope this answers your question.

Regards,

[AKhalpakhchyan]

Thanks, Muhammad!

I will take note of the problem with pom.xml.

I found the problem source. That was a system with a duplicate name in the defender.config

Regards,

Andrey

[musiddiqui]

Hi Andrey,

Good to know that you were able to find the source of the problem. Let me know if you have any other questions.

Regards,