Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Risk accepted status prevent from closing after finding is fixed #10769

Open
1 of 3 tasks
WojTecH94 opened this issue Aug 16, 2024 · 2 comments
Open
1 of 3 tasks

Risk accepted status prevent from closing after finding is fixed #10769

WojTecH94 opened this issue Aug 16, 2024 · 2 comments
Labels

Comments

@WojTecH94
Copy link
Contributor

WojTecH94 commented Aug 16, 2024

Bug description
When a finding have risk accepted status in DefectDojo it cannot be closed (mitigated) by new test import (tested on Tenable importer).

Steps to reproduce
Steps to reproduce the behavior:

  1. Import some test results
  2. Add Risk Acceptance to one of the findings in DefectDojo
  3. Remove earlier accepted finding from test results file
  4. Import modified file
  5. See that risk accepted finding is not mitigated

Expected behavior
When risk accepted finding is fixed it should change status to "Mitigated" and "Risk acceptance" status should (probably) be removed, because Risk acceptance is no longer needed for non existing vulnerability.

Deployment method (select with an X)

  • Docker Compose
  • Kubernetes
  • GoDojo

DefectDojo Version
tested on: 2.35.2 and 2.37.1

@WojTecH94 WojTecH94 added the bug label Aug 16, 2024
@mtesauro
Copy link
Contributor

@WojTecH94 I believe this was fixed in #9050

@WojTecH94
Copy link
Contributor Author

WojTecH94 commented Sep 5, 2024

@mtesauro sadly it was not fixed in version 2.38.0 :( I just tested it and risk accepted findings are not getting mitigated during new import with close old findings option checked.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants