Viewing vulnerability data

Edit online

After you upload vulnerability data (CVE or non-CVE exposure scans) to Concert, you can review the assessment results within the Vulnerability dimension page, Arena view, or within the individual application and component definitions.

Viewing CVEs in the Vulnerability dimension

The Vulnerability dimension provides a centralized view of Common Vulnerabilities and Exposures (CVEs) affecting your applications and runtime environments. Concert correlates vulnerability scan data with application definitions, repositories, build artifacts, container images, and runtime environments to help you understand the security posture of your application landscape.

Vulnerability data is displayed only for correlated application components. This includes applications that are automatically discovered from source code repositories, as well as vulnerabilities associated with shared repositories, build artifacts, images, and runtime environments.

If an application is updated to remove an associated repository or build artifact, related vulnerability findings continue to appear until the uncorrelated artifacts and their associated vulnerability scan data are explicitly deleted.

To view vulnerability assessment results, go to Protect > Dimensions > Vulnerability.

The Vulnerability page contains the following tabs:
  • CVEs, which displays Common Vulnerabilities and Exposures that affect your applications and runtime environments.
  • Exposures, which displays non-CVE security findings from DAST and SAST scans.

The CVEs tab is displayed by default.

Figure 1. Vulnerability landing page
Screenshot of Vulnerability page with CVEs tab selected, showing a detailed view and analysis of uploaded CVE data.

By default, the CVEs page displays vulnerability information across all correlated applications, application versions, deployments, and runtime environments.

If you want to review vulnerabilities for a specific application version or deployment, use the selectors at the top of the page.

You can view vulnerability information for:
  • Application versions
  • Application version tags
  • Deployments
  • Deployment tags

When you select one or more values, the dashboard summaries and vulnerability findings are updated to display information only for the selected application versions, version tags, deployments, or deployment tags.

Click Reset filters to return to the default view and display vulnerability information across all available application versions and deployments.

The page also displays the time when the vulnerability dashboard was last refreshed.

Reviewing the vulnerability summary

The summary section provides a high-level view of the current vulnerability posture for the selected application versions, deployments, or the overall application landscape.

Note: Vulnerability findings are available after vulnerability scan data is ingested. However, the Priority breakdown, Vulnerabilities, and Fix availability summary widgets are refreshed periodically and might not immediately reflect newly ingested findings. Depending on when the summary refresh occurs, these dashboard summaries can take up to 6 hours to display the latest data. Use the As of timestamp to determine when the summary metrics were last updated.

Priority breakdown

The Priority breakdown chart displays the distribution of vulnerability findings across the configured priority levels.

The chart categorizes findings as:
  • Priority 1
  • Priority 2
  • Priority 3
  • Deprioritized

The value displayed at the center of the chart represents the total number of vulnerability findings.

Vulnerabilities

The Vulnerabilities tile summarizes the current vulnerability inventory and remediation status by displaying:
  • Total findings
  • Unique CVEs
  • Overdue findings
The tile also provides a breakdown of findings by remediation status, including:
  • Open
  • Closed
  • False positive
  • Deferred
Note: A single CVE can affect multiple application components, build artifacts, images, or runtime environments. Therefore, the total number of vulnerability findings can be greater than the number of unique CVEs.

Fix availability

The Fix availability tile displays the percentage of vulnerability findings for which a supported fix is currently available.

The tile also shows:
  • Findings with an available fix
  • Findings for which no fix is currently available

Use these dashboard summaries to understand the overall vulnerability posture before investigating individual findings.

Reviewing vulnerability findings

The Vulnerability findings section lists the vulnerability findings that match the currently selected application versions, deployments, and other selected criteria.

Depending on the type of vulnerabilities that you want to review, select one of the following tabs:
  • Application CVEs
  • Host CVEs
You can use the toolbar above the table to:
  • Search for specific CVEs.
  • Filter the displayed findings.
  • Refresh the findings table.
  • Upload an additional vulnerability scan.
The table contains detailed information about each vulnerability finding, including:
  • Repository or image in which the vulnerability was found
  • Package
  • CVE identifier
  • Fixed version, if available
  • Finding age
  • CVSS score
  • Concert risk score
  • Environment
  • Scan source
  • Scan type
  • Application
  • Assessment state

The table supports sorting on applicable columns to help you prioritize and investigate vulnerabilities.

Filtering vulnerability findings

Click the Filter icon to refine the vulnerability findings displayed in the table.

You can filter the findings by using the following categories:
  • Priority
  • Severity (CVSS)
  • Overdue
  • Upcoming deadlines
  • Finding age
  • Remediation status

Use the available filter options to refine the vulnerability findings displayed in the table and focus on the findings that are most relevant to your investigation.

Figure 2. Vulnerability findings filter panel
Screenshot of the Vulnerability findings filter panel..

Viewing CVE details

Click the name of a CVE in the Vulnerability findings table to open the detailed view for that vulnerability.

Figure 3. CVE details page
Screenshot of the CVE details page.
The CVE details page provides key information about the selected CVE, including:
  • Severity
  • CVSS score
  • Exploitability factor
The Overview tab provides information about the CVSS vector, vulnerability description, aliases, and related CVEs (when available). The page also includes AI-assisted insights that help you understand the vulnerability and evaluate possible remediation approaches, including:
  • A detailed explanation of the attack vector
  • Information about active exploits and remediation guidance

Select the Applications impacted tab to view the applications that are affected by the selected CVE.

Figure 4. Applications impacted
Screenshot of applications impacted tab.

The Applications impacted tab lists all applications that contain the selected vulnerability and provides additional application context, including the application version, application owner or contact, total findings associated with the application, tags, business criticality, data sensitivity, and application creation and update details. This view helps you identify which applications are affected and prioritize remediation based on business impact.

Select the Blast radius tab to visualize how the selected CVE propagates across your application landscape.

Figure 5. Vulnerability Blast radius
Screenshot of Blast radius topology view.

The topology view graphically displays the relationships between the vulnerable package and the affected resources, including build artifacts, applications, runtime environments, and public access points. This graphical view helps you understand the overall impact of the vulnerability across your environment.

You can use the search field to locate specific resources within the topology. The Applications and Environments filters help you focus the visualization on selected applications or runtime environments. When you hover over a build artifact, application, or environment, Concert highlights the related nodes and connections, making it easier to understand how the vulnerability affects your application topology and downstream resources.

Viewing non-CVE exposures in the Vulnerability dimension

In the Vulnerability dimension, click the Exposures tab to view findings from dynamic application security testing (DAST) and static application security testing (SAST) scans that are uploaded to Concert.

Figure 6. Vulnerability Exposures tab
Screenshot of the Vulnerability Exposures tab.
The Exposures page provides a summary of your non-CVE exposure posture, including the following information:
  • Total non-CVE exposures
  • Priority 1 exposures
  • Exposures impacting public access points
  • Exposures with open tickets
  • Exposures with available solutions
Tip: Click a summary tile to filter the exposure rules table by the selected metric.

The Most common exposure rules chart shows the exposure rules that occur most frequently across your application landscape, along with the number of findings for each rule.

The table below the dashboard lists the identified exposure rules and includes information such as:
  • Rule
  • Scan type
  • Number of open assessments
  • Highest finding priority
  • Date the rule was found

Click a Rule to view the individual exposure assessments associated with that rule.

The rule details page displays the individual exposure findings and includes information such as:
  • Source
  • Exposure path
  • Age
  • Priority
  • Scan source
  • Assessment state
  • Ticket
  • Environment

From the Ticket column, click Open ticket to create a ticket for the selected exposure in a connected third-party issue tracking system. For more information, see Opening tickets to address vulnerabilities.

Viewing prioritized CVEs in the Arena view

The Arena view presents an interactive, topological view of your application and environment components and their dependencies. You can use the toggles to show or hide dimensional data, including individual toggles for CVEs identified as "priority 1" in the context of your application topology.


Screenshot of the Arena view with the "Priority 1 CVEs" toggle enabled to show the impact of each high-priority CVE.

Hover over an individual CVE node to view its specific blast radius, as in the impacted components and their dependencies, across the application topology.


Screen shot of Arena view with Priority 1 CVEs toggle enabled and the mouse hovering over an individual CVE node to show additional details and to highlight the specific components and dependencies impacted.

You can click the CVE node to be redirected to additional CVE details within the Vulnerability dimension.

Viewing non-CVE exposures in the Arena view

The Arena view presents an interactive, topological view of your application and environment components and their dependencies. You can use the toggles to show or hide dimensional data, including individual toggles for non-CVE exposures identified as "priority 1" in the context of your application topology.


Screenshot of Arena view with Priority 1 exposures toggle enabled, showing the impact of high priority non-CVE exposures on your applications and environments

Hover over an individual exposure node to view its specific blast radius, as in the impacted components and their dependencies, across the application topology.


Screenshot of Arena view with the mouse hovering over an individual exposure node to highlight the specific application components and dependencies impacted by it

Viewing all CVEs impacting an application

You can view a detailed list of the CVEs impacting a specific application or component in your Concert inventory. Go to Inventory > Applications, and then use the Applications, Repositories, or Build artifacts tabs to view the corresponding details.
Note: Code repositories and build artifacts are application components, which are part of your application definitions. You can click the name of an application to view its associated components.

The Applications page (Inventory > Applications) contains a list of applications defined in your Concert instance to which you have access.

Click the name of an application, select the required application version, and then click the CVE findings tab to view the CVEs affecting that application version.

Similarly, you can go back and navigate to the Repositories or Build artifacts tabs to view CVEs impacting specific components within your application definitions. Details shown in the application or component-specific view are similar to what appears in the Vulnerability dimension page (CVEs tab).

To create a ticket for a vulnerability finding, open the affected application from Inventory > Applications, navigate to the required application version, and then open the CVE findings tab. From the Ticket column, click Open ticket for the required finding. For more information, see Opening tickets to address vulnerabilities.