Scoring & Prioritization on DefectDojo Documentation

CVSS Version Support

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo supports CVSS metadata on Findings, including the CVSS 4.0 standard. This page describes which CVSS versions are stored end-to-end, where you can enter or view them, and what to expect from parser-side coverage.

EPSS / KEV

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro automatically enriches your Findings with two external threat-intelligence sources — EPSS and CISA KEV — so that prioritization reflects how likely a vulnerability is to be exploited, not just its CVSS severity. Both sources match to Findings by CVE, refresh on a daily schedule, and feed directly into each Finding’s computed priority score.

Reachability

Mon, 01 Jan 0001 00:00:00 +0000

A Critical CVE in code your application never calls is not the same risk as the same CVE on a live request path. Reachability captures that difference: DefectDojo Pro records whether each Finding’s vulnerable code can actually be reached, shows you where that conclusion came from, and feeds it into the Finding’s computed priority.

Asset Exposure

Mon, 01 Jan 0001 00:00:00 +0000

A Critical vulnerability on a service anyone on the internet can reach is not the same risk as the same vulnerability on an isolated internal system, or on a branch nobody has deployed. Asset Exposure captures both differences: DefectDojo Pro records how reachable each asset is from outside, whether each Finding’s code is actually running in production, shows you where those conclusions came from, and feeds both into the Finding’s computed priority.