Which of the following formats are used to describe a code scanning alert from CodeQL?

The correct answer is A. Common Weakness Enumeration (CWE). CodeQL code scanning alerts are categorized using the Common Weakness Enumeration (CWE) standard, which classifies types of software weaknesses (e.g., CWE-89 for SQL Injection, CWE-79 for XSS). CVE (D) identifies specific known vulnerability instances in software products. GHSA…

Configure and use Code Scanning with CodeQL

Question

Options

ACommon Weakness Enumeration (CWE)
BVulnerability Exploitability eXchange (VEX)
CGitHub Security Advisory (GHSA)
DCommon Vulnerabilities and Exposures (CVE)

How the community answered

(31 responses)

A
94% (29)
B
3% (1)
D
3% (1)

Explanation

CodeQL code scanning alerts are categorized using the Common Weakness Enumeration (CWE) standard, which classifies types of software weaknesses (e.g., CWE-89 for SQL Injection, CWE-79 for XSS). CVE (D) identifies specific known vulnerability instances in software products. GHSA (C) is GitHub's advisory format. VEX (B) is used to communicate exploitability status. CWE is the format CodeQL uses to describe the class of weakness found.

Topics

#CodeQL Alerts#Code Scanning#CWE#Vulnerability Classification

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice