Skip to content

CVE Scanning

Escape automatically scans every detected technology for known CVEs (Common Vulnerabilities and Exposures). Once technologies are identified on your assets, they are matched against a vulnerability database to surface dependencies with known security issues.

Why it matters: vulnerable dependencies are one of the most common attack vectors. Escape turns your technology inventory into a continuously updated vulnerability assessment without any manual effort.

How It Works

  1. Technology Detection: Escape identifies technologies running on your assets through fingerprinting and dependency analysis.
  2. Vulnerability Matching: Each detected technology is matched against known advisories in a vulnerability database.
  3. Finding Generation: When a match is found, a finding is created with full context: CVE ID, Escape severity, advisory CVSS score and vector (when available), description, affected versions, fix version (when available), and reference links.

Versioned and Versionless Matching

The accuracy of CVE matching depends on whether a specific version was detected:

Detection Matching approach Confidence
Versioned (for example express@4.17.1) Precise matching against known affected version ranges High: only CVEs that affect the exact version are reported
Versionless (for example nginx, no version) A selection of potential CVEs associated with the technology Lower: potential CVEs are grouped into one issue per technology with reduced severity because the affected version hasn't been confirmed

For versionless findings, verify the version in use against the advisory's affected versions before treating the finding as confirmed.

What Gets Reported

Each CVE finding includes:

  • CVE ID: The unique identifier (for example CVE-2024-12345)
  • Severity: Escape's issue severity can differ from the advisory's CVSS rating. Findings with an unknown version have reduced severity to reflect uncertainty
  • Description: What the vulnerability is and how it can be exploited
  • Affected Versions: The version range impacted by the CVE
  • Fix Version: The version that resolves the vulnerability (when available)
  • References: Links to advisories and technical details

Findings appear as Dependency with Known CVE when a version is confirmed, or Dependency May Be Affected by Known CVE when the version is unknown. Findings are linked to the affected technology.

Coverage

CVE matching covers detected technologies such as:

  • Web servers, application frameworks, and programming languages
  • JavaScript libraries, Python packages, and dependencies from all major package ecosystems
  • Databases, CMS platforms, reverse proxies, and infrastructure software
  • Frontend JavaScript libraries embedded in web applications

Vulnerability Reference

For detailed information on specific vulnerability tests, see the Security Tests Reference. CVE-related tests include: