Skip to main content

GetProductVulnerability

Will query if product vulnerabilities exist along with severity and related information.

Syntax​

Method ID​

#define WAAPI_MID_GET_PRODUCT_VULNERABILITY 50505

JSON Input Structure​

{
  "input": {
    "method": 50505,
    "signature": number,
    "sources": [
      string,
      ...
    ],
    "online": number,
    "version_range": string,
    "package_filter": [
      string,
      ...
    ],
    "detect_affected_instances": boolean,
    "include_remediation_patches": boolean,
    "skip_extra_installed_os_patches_checks": boolean
  }
}

Input Properties​

ParameterTypeDescription
sourcesarray<string>(optional) An array of sources of vulnerability to query from. Allowed values are 'CVE', 'MSB' and 'KB'. Default value is 'CVE'. (Only applicable when using vmod.dat).
onlinenumber(optional) Whether to use online database or not. Value 0 will disable online mode, value 1 will enable it with lightweight database and value 2 will get full online database. Default value is 0.
version_rangestring(optional) A version range string is used to query all the CVEs affecting a product within the specified range. Default value is empty string.
The valid format of a version range is as follows: (a, b), (a, b], [a, b), [a, b] with 'a' as start of range and 'b' as end of range, separated by a comma ','. Parentheses '()' mean start/end exclusive and square brackets '[]' mean inclusive. For example: range '[ 5.0, 12.0 )' will return CVEs that affect versions between 5 and 12, but not versions >= 12.
Version '-1' can be specified as a special value for either start or end (or both) which means unlimited version. For example: [-1, 5.0] returns CVEs affecting all versions that are smaller than or equal to 5.0.
package_filterarray<string>(optional) (Linux only) (Linux only) A list of package names used to filter the installed packages before executing the query.
If not specified, provided with an empty array, or given ["*"], the query is executed on the full list of installed packages.
Example: if provided ["python", "libc6"], the resulting packages may include, but will be limited, to python and libc6.
detect_affected_instancesboolean(optional) (Linux only) (Linux only) Enable detection of application instances affected by each CVE vulnerability. When set to true, each CVE entry in the response will include the cves.affected_app_instances field, listing the application instances impacted by that vulnerability.
include_remediation_patchesboolean(optional) (Windows only) (Windows only) Enable detection of optimal KB that fix CVE vulnerability. When set to true, each CVE entry in the response will include the cves.resolution.remediation_patches field, listing the optimal KB that fix vulnerability.
skip_extra_installed_os_patches_checksboolean(optional) (Windows only) (Windows only) Skip extra checks for installed OS patches. When set to true, the missing and installed KB lists are built solely from the OESIS V4 patch APIs (GetMissingPatches and GetInstalledPatches) together with the KB build-history derivation. When set to false or omitted, the default behavior is preserved. Default: false.

JSON Output Structure​

{
  "result": {
    "method": 50505,
    "code": number,
    "timing": number,
    "timestamp": string,
    "has_vulnerability": boolean,
    "has_kb": boolean,
    "severity": string,
    "cves": [
      {
        "static_id": number,
        "cve": string,
        "severity": string,
        "severity_index": number,
        "description": string,
        "affected_app_instances": [
          {
            "id": string,
            "path": string
          },
          ...
        ],
        "details": [
          {
            "cpe": [
              {
                "cpe_2_3": string,
                "version_start_include": string,
                "version_start_exclude": string,
                "version_end_include": string,
                "version_end_exclude": string
              },
              ...
            ],
            "cwe": string,
            "published_epoch": number,
            "last_modified_epoch": number,
            "cisa": {
              "published_epoch": number,
              "due_epoch": number,
              "knownRansomwareCampaignUse": string
            },
            "references": [
              {
                "url": string
              },
              ...
            ],
            "security_protection": string,
            "cvss_2_0": {
              "score": string,
              "access_vector": string,
              "access_complexity": string,
              "authentication": string,
              "confidentiality_impact": string,
              "integrity_impact": string,
              "availability_impact": string,
              "source": string,
              "generated_on_epoch": number
            },
            "cvss_3_0": {
              "impact_score": string,
              "vector_string": string,
              "attack_vector": string,
              "attack_complexity": string,
              "privileges_required": string,
              "scope": string,
              "confidentiality_impact": string,
              "integrity_impact": string,
              "availability_impact": string,
              "base_score": string,
              "base_severity": string,
              "exploitability_score": string
            },
            "cvss_4_0": {
              "vector_string": string,
              "base_score": string,
              "base_severity": string,
              "attack_vector": string,
              "attack_complexity": string,
              "attack_requirements": string,
              "privileges_required": string,
              "user_interaction": string,
              "vulnerable_system_confidentiality": string,
              "vulnerable_system_integrity": string,
              "vulnerable_system_availability": string,
              "subsequent_system_confidentiality": string,
              "subsequent_system_integrity": string,
              "subsequent_system_availability": string,
              "exploit_maturity": string,
              "safety": string,
              "automatable": string,
              "recovery": string,
              "value_density": string,
              "vulnerability_response_effort": string,
              "provider_urgency": string
            },
            "epss": {
              "score": string,
              "percentile": string,
              "date": string
            },
            "resolution": [
              {
                "product_id": number,
                "product_name": string,
                "text": string,
                "patches": [
                  {
                    "update_id": string,
                    "installable": boolean
                  },
                  ...
                ],
                "remediation_patches": [
                  {
                    "update_id": string,
                    "install_order": number
                  },
                  ...
                ],
                "advisory_url": string,
                "higher_than_version": string,
                "higher_than_or_equal_to_version": string,
                "overlay": string,
                "running_on_os": string,
                "affected_packages": [
                  {
                    "name": string,
                    "version": string,
                    "maintainer": string,
                    "type": number
                  },
                  ...
                ]
              },
              ...
            ]
          },
          ...
        ]
      },
      ...
    ],
    "msbs": [
      {
        "static_id": number,
        "severity": string,
        "severity_index": number,
        "description": string,
        "msb_id": string,
        "kb_id": number,
        "details": {
          "published_epoch": number,
          "cves": [
            string,
            ...
          ],
          "supersedes": [
            {
              "kb_id": number,
              "msb_id": string
            },
            ...
          ],
          "patch_resolution": {
            "kb_id": number,
            "url": string
          }
        }
      },
      ...
    ],
    "kbs": [
      {
        "static_id": number,
        "severity": string,
        "severity_index": number,
        "description": string,
        "kb_id": number,
        "details": {
          "type": string,
          "search_url": string,
          "detail_url": string,
          "affected_products": [
            {
              "severity_index": number,
              "severity": string,
              "advisory_url": string,
              "published_epoch": number,
              "impact": string,
              "product": string,
              "platform": string,
              "cve": string
            },
            ...
          ]
        }
      },
      ...
    ],
    "source_timestamp": number
  }
}

Output Properties​

PropertyTypeDescription
result.methodnumberThe method ID that generated this result.
result.codenumberThe result code. See Result Codes.
result.timingnumberThe measured time for the method call in milliseconds.
result.timestampstringThe timestamp in seconds of when the call was made.
result.has_vulnerabilitybooleanIndicates whether any CVEs have been associated with the particular product
result.has_kbbooleanIndicates whether any MSBs or KBs have been associated with the particular product
result.severitystringString description of Severity level: 'low', 'moderate', 'important', 'critical', 'unknown'.
result.cvesarray<object>(optional) A list of CVEs associated with the hash.
result.cves.static_idnumberAn OPSWAT identifier for the vulnerability.
result.cves.cvestringA CVE identifier string.
result.cves.severitystringString description of Severity level: 'low', 'moderate', 'important', 'critical', 'unknown'.
result.cves.severity_indexnumberAn OPSWAT-assigned 100 point scale numerical description of Severity level with 100 being greatest and 0 being unknown.
result.cves.descriptionstringA text description of the specific vulnerability.
result.cves.affected_app_instancesarray<object>(optional) (Linux only) A list of application instances affected by this vulnerability.
result.cves.affected_app_instances.idstring(optional) (Linux only) The instance ID of the affected application.
result.cves.affected_app_instances.pathstring(optional) (Linux only) The file path of the affected application instance.
result.cves.detailsobjectA set of optional vulnerability details.
result.cves.details.cpearray<object>An array of CPE objects related to the product (currently supported with v2mod.dat).
result.cves.details.cpe.cpe_2_3stringCPE string based on CPE 2.3 format
result.cves.details.cpe.version_start_includestring(optional) The starting version (inclusive) of the product affected by the vulnerability.
result.cves.details.cpe.version_start_excludestring(optional) The starting version (exclusive) of the product affected by the vulnerability.
result.cves.details.cpe.version_end_includestring(optional) The ending version (inclusive) of the product affected by the vulnerability.
result.cves.details.cpe.version_end_excludestring(optional) The ending version (exclusive) of the product affected by the vulnerability.
result.cves.details.cwestringA CWE group identification string.
result.cves.details.published_epochnumberAn epoch timestamp indicating source publishing time.
result.cves.details.last_modified_epochnumberAn epoch timestamp indicating source last update time.
result.cves.details.cisaobject(optional) A set of information about the CVE, published by CISA.
result.cves.details.cisa.published_epochnumberAn epoch timestamp indicating CISA source publishing time.
result.cves.details.cisa.due_epochnumberAn epoch timestamp indicating CISA source due date time.
result.cves.details.cisa.knownRansomwareCampaignUsestringIndicate if this vulnerability is known to have been associated with a ransomware campaign.
result.cves.details.referencesarray<object>An array of external reference links and their releated information.
result.cves.details.references.urlstringA reference URL.
result.cves.details.security_protectionstringA security protection descriptor.
result.cves.details.cvss_2_0object(optional) A set of CVSS 2.0 severity information.
result.cves.details.cvss_2_0.scorestringA CVSS 2.0 10-point severity score.
result.cves.details.cvss_2_0.access_vectorstringA CVSS 2.0 access-vector descriptor.
result.cves.details.cvss_2_0.access_complexitystringA CVSS 2.0 access-complexity descriptor.
result.cves.details.cvss_2_0.authenticationstringA CVSS 2.0 authentication descriptor.
result.cves.details.cvss_2_0.confidentiality_impactstringA CVSS 2.0 confidentiality impact descriptor.
result.cves.details.cvss_2_0.integrity_impactstringA CVSS 2.0 integrity impact descriptor.
result.cves.details.cvss_2_0.availability_impactstringA CVSS 2.0 availability impact descriptor.
result.cves.details.cvss_2_0.sourcestringA CVSS 2.0 source descriptor.
result.cves.details.cvss_2_0.generated_on_epochnumberThe timestamp the CVSS 2.0 was generated.
result.cves.details.cvss_3_0object(optional) A set of CVSS 3.0 severity information.
result.cves.details.cvss_3_0.impact_scorestringA CVSS 3.0 impact score.
result.cves.details.cvss_3_0.vector_stringstringA CVSS 3.0 vector string.
result.cves.details.cvss_3_0.attack_vectorstringA CVSS 3.0 attack vector.
result.cves.details.cvss_3_0.attack_complexitystringA CVSS 3.0 attack complexity descriptor.
result.cves.details.cvss_3_0.privileges_requiredstringA CVSS 3.0 privileges descriptor.
result.cves.details.cvss_3_0.scopestringA CVSS 3.0 scope.
result.cves.details.cvss_3_0.confidentiality_impactstringA CVSS 3.0 confidentiality impact.
result.cves.details.cvss_3_0.integrity_impactstringA CVSS 3.0 integrity impact.
result.cves.details.cvss_3_0.availability_impactstringA CVSS 3.0 availability impact.
result.cves.details.cvss_3_0.base_scorestringA CVSS 3.0 base score.
result.cves.details.cvss_3_0.base_severitystringA CVSS 3.0 base severity descriptor.
result.cves.details.cvss_3_0.exploitability_scorestringA CVSS 3.0 exploitability score.
result.cves.details.cvss_4_0object(optional) A set of CVSS 4.0 severity information. This field only exists if CVSS 4.0 data is available for the CVE.
result.cves.details.cvss_4_0.vector_stringstringA CVSS 4.0 vector string.
result.cves.details.cvss_4_0.base_scorestringA CVSS 4.0 base score (CVSS-B), ranging from 0.0 to 10.0.
result.cves.details.cvss_4_0.base_severitystringA CVSS 4.0 base severity descriptor: NONE, LOW, MEDIUM, HIGH, CRITICAL.
result.cves.details.cvss_4_0.attack_vectorstringA CVSS 4.0 attack vector descriptor (AV).
result.cves.details.cvss_4_0.attack_complexitystringA CVSS 4.0 attack complexity descriptor (AC).
result.cves.details.cvss_4_0.attack_requirementsstringA CVSS 4.0 attack requirements descriptor (AT).
result.cves.details.cvss_4_0.privileges_requiredstringA CVSS 4.0 privileges required descriptor (PR).
result.cves.details.cvss_4_0.user_interactionstringA CVSS 4.0 user interaction descriptor (UI).
result.cves.details.cvss_4_0.vulnerable_system_confidentialitystringA CVSS 4.0 vulnerable system confidentiality impact descriptor (VC).
result.cves.details.cvss_4_0.vulnerable_system_integritystringA CVSS 4.0 vulnerable system integrity impact descriptor (VI).
result.cves.details.cvss_4_0.vulnerable_system_availabilitystringA CVSS 4.0 vulnerable system availability impact descriptor (VA).
result.cves.details.cvss_4_0.subsequent_system_confidentialitystringA CVSS 4.0 subsequent system confidentiality impact descriptor (SC).
result.cves.details.cvss_4_0.subsequent_system_integritystringA CVSS 4.0 subsequent system integrity impact descriptor (SI).
result.cves.details.cvss_4_0.subsequent_system_availabilitystringA CVSS 4.0 subsequent system availability impact descriptor (SA).
result.cves.details.cvss_4_0.exploit_maturitystring(optional) A CVSS 4.0 exploit maturity descriptor (E), Threat metric group. Only present when provided by the source.
result.cves.details.cvss_4_0.safetystring(optional) A CVSS 4.0 safety supplemental descriptor (S). Only present when provided by the source.
result.cves.details.cvss_4_0.automatablestring(optional) A CVSS 4.0 automatable supplemental descriptor (AU). Only present when provided by the source.
result.cves.details.cvss_4_0.recoverystring(optional) A CVSS 4.0 recovery supplemental descriptor (R). Only present when provided by the source.
result.cves.details.cvss_4_0.value_densitystring(optional) A CVSS 4.0 value density supplemental descriptor (V). Only present when provided by the source.
result.cves.details.cvss_4_0.vulnerability_response_effortstring(optional) A CVSS 4.0 vulnerability response effort supplemental descriptor (RE). Only present when provided by the source.
result.cves.details.cvss_4_0.provider_urgencystring(optional) A CVSS 4.0 provider urgency supplemental descriptor (U). Only present when provided by the source.
result.cves.details.epssobject(optional) A set of Exploit Prediction Scoring System (EPSS) data. This field only exists if EPSS data is available for the CVE.
result.cves.details.epss.scorestringThe EPSS probability score, ranging from 0 to 1.
result.cves.details.epss.percentilestringThe EPSS percentile rank, ranging from 0 to 1.
result.cves.details.epss.datestringThe EPSS model date on which the score and percentile were generated, in YYYY-MM-DD format.
result.cves.details.resolutionarray<object>(optional) List of recommendations to patch the vulnerability.
result.cves.details.resolution.product_idnumber(optional) The identifier of the queried product or a product related to this vulnerability.
result.cves.details.resolution.product_namestring(optional) The name of a product related to this vulnerability.
result.cves.details.resolution.textstring(optional) Recommendation for the vulnerability in plain text.
result.cves.details.resolution.patchesarray<object>(optional) Defines list of patches that can fix the CVE.
result.cves.details.resolution.patches.update_idstring(optional) Defines KB id for this KB or patch id for 3rd-party apps.
result.cves.details.resolution.patches.installableboolean(optional) The KB installable to this machine.
result.cves.details.resolution.remediation_patchesarray<object>(optional) An ordered list of optimal KB patches to remediate the CVE. Present only when the input parameter include_remediation_patches is true.
result.cves.details.resolution.remediation_patches.update_idstring(optional) The KB identifier of the patch to install.
result.cves.details.resolution.remediation_patches.install_ordernumber(optional) The sequential position of this KB in the installation order. Starts at 1 and increments by 1 for each subsequent patch. KBs must be installed in ascending order.
result.cves.details.resolution.advisory_urlstring(optional) URL to the advisory webpage of the vulnerability.
result.cves.details.resolution.higher_than_versionstring(optional) Define a version that the product should update to a newer one to patch the vulnerability.
result.cves.details.resolution.higher_than_or_equal_to_versionstring(optional) Define a version that the product should update to or a newer one to patch the vulnerability.
result.cves.details.resolution.overlaystring(optional) A tag describes different version of a package provided by distro. For example, Ubuntu provides "esm-apps", "esm-infra", "fips", "fips-preview",... type of package.
result.cves.details.resolution.running_on_osstring(optional) The operating system the product runs on.
result.cves.details.resolution.affected_packagesarray<object>(optional) List of installed packages belong to this affected source.
result.cves.details.resolution.affected_packages.namestring(optional) Name of the affected package.
result.cves.details.resolution.affected_packages.versionstring(optional) Version of the affected package.
result.cves.details.resolution.affected_packages.maintainerstring(optional) Name of maintainer of the package.
result.cves.details.resolution.affected_packages.typenumber(optional) Type of package (0 - OS, 1 - Application).
result.msbsarray<object>(optional) A list of vulnerabilities in Microsoft Security Bulletin (MSB) format. This field only exist if MSB source is specified in the input.
result.msbs.static_idnumberAn OPSWAT identifier for the vulnerability.
result.msbs.severitystringString description of Severity level: 'low', 'moderate', 'important', 'critical', 'unknown'.
result.msbs.severity_indexnumberA 5 point scale numerical description of Severity level with 5 being greatest and 0 being unknown.
result.msbs.descriptionstringA text description of the specific vulnerability.
result.msbs.msb_idstringIdentifier of the MSB.
result.msbs.kb_idnumberKnowledgebase identifier of the MSB.
result.msbs.detailsobjectA set of additional vulnerability details.
result.msbs.details.published_epochnumberAn epoch timestamp indicating source publishing time.
result.msbs.details.cvesarray<string>A list of Common Vulnerabilities and Exposures (CVE) identifiers associated with the MSB.
result.msbs.details.patch_resolution.kb_idnumberKnowledgebase identifier of the security patch for this vulnerability.
result.msbs.details.patch_resolution.urlstringThe URL to the detail information of the security patch.
result.msbs.details.supersedesarray<object>A list of MSBs that were replaced by this MSB.
result.msbs.details.supersedes.kb_idnumberKnowledgebase identifier of a MSB that was replaced by this MSB.
result.msbs.details.supersedes.msb_idstringIdentifier of a MSB that was replaced by this MSB.
result.kbsarray<object>(optional) A list of vulnerabilities in Microsoft Knowledge Base format. This field only exist if 'KB' source is specified in the input.
result.kbs.static_idnumberAn OPSWAT identifier for the vulnerability.
result.kbs.severitystringString description of Severity level: 'low', 'moderate', 'important', 'critical', 'unknown'.
result.kbs.severity_indexnumberA 5 point scale numerical description of Severity level with 5 being greatest and 0 being unknown.
result.kbs.descriptionstringA text description of the specific vulnerability.
result.kbs.kb_idnumberKnowledgebase identifier of the vulnerability.
result.kbs.detailsobjectA set of additional vulnerability details.
result.kbs.details.typestringType of KB
result.kbs.details.search_urlstringSearch URL of the vulnerability.
result.kbs.details.detail_urlstringURL to vulnerability's detail information.
result.kbs.details.affected_productsarray<object>Array of information of products affected by the vulnerability.
result.kbs.details.affected_products.severity_indexnumberA 5 point scale numerical description of Severity level with 5 being greatest and 0 being unknown.
result.kbs.details.affected_products.severitystringString description of Severity level: 'low', 'moderate', 'important', 'critical', 'unknown'.
result.kbs.details.affected_products.advisory_urlstringURL to the advisory webpage of the vulnerability.
result.kbs.details.affected_products.published_epochnumberAn epoch timestamp indicating source publishing time.
result.kbs.details.affected_products.impactstringDescription of the impact of the vulnerability on the product.
result.kbs.details.affected_products.productstringName of the product affected by the vulnerability.
result.kbs.details.affected_products.platformstring(optional) Name of the platform the affected product run on.
result.kbs.details.affected_products.cvestring(optional) Knowledgebase identifier of the vulnerability.
result.source_timestampnumber(optional) The timestamp of cloud data being used for method with online mode.

Result Codes​

CodeNameDescription
0WAAPI_OKThe operation completed successfully.
note

Other codes may be returned. See the full Result Codes reference for the complete list.

Remarks​

Error Handling​

The results of this function are determined by the error code returned by the call. If successful, WAAPI_OK or a special success code will be returned. Always check both the function return value and the result.code field in the output JSON.

Examples​

Examples will be added here demonstrating the usage of this method.

See Also​

Last updated: 2026-10-01