Forum Discussion
Patch Report (Plugin 66334) Supersedence Changes Improved...
Patch Report (Plugin 66334) Supersedence Changes
Improved Reporting of Superseded Findings with plugin 66334
Change
Currently, plugin 66334, which calculates the supersedence chains for Nessus findings, provides a complete report of all CVEs covered by a top-level finding when Report Verbosity is set to Verbose. When the configuration setting “Show missing patches that have been superseded” is turned off, Nessus scan results will only include the top-level finding and the CVEs that are explicitly contained in that top-level plugin. Following this change, configuring that setting to be off will cause the plugin to show the verbose plugin output, which includes the full set of CVEs that are superseded by a top-level finding. This will allow customers to better track the severity of all vulnerabilities that are contained as part of the superseded findings.
Impact
For anyone that currently runs scans with “Show missing patches that have been superseded” turned off and Report Verbosity set to Normal or Low, you can expect a slight increase in size for your scan results, given the increased plugin output for this finding.
Plugin
Patch Report (66334)
Target Release Date
February 08, 2023
2 Replies
Is this release still planned for today? This would be a great improvement for visibility to the actual CVEs impacting systems that are otherwise "lost".
Is the CVE data this plugin surfaces searchable using the CVE query in Tenable.io (or via the API)?
My use case is using this data to determine the true number of vulnerabilities from the CISA vulnerability database that are in my environment.
