doc/user/application_security/vulnerabilities/index.md


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

---
type: reference, howto
stage: Secure
group: Threat Insights
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#designated-technical-writers
---

# Standalone Vulnerability pages

> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/13561) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.0.

Each security vulnerability in the [Security Dashboard](../security_dashboard/index.md#project-security-dashboard) has its own standalone
page.

![Standalone vulnerability page](img/standalone_vulnerability_page_v13_1.png)

On the standalone vulnerability page, you can interact with the vulnerability in
several different ways:

- [Change the Vulnerability Status](#changing-vulnerability-status) - You can change the
  status of a vulnerability to **Detected**, **Confirmed**, **Dismissed**, or **Resolved**.
- [Create issue](#creating-an-issue-for-a-vulnerability) - Create a new issue with the
  title and description pre-populated with information from the vulnerability report.
  By default, such issues are [confidential](../../project/issues/confidential_issues.md).
- [Solution](#automatic-remediation-solutions-for-vulnerabilities) - For some vulnerabilities,
  a solution is provided for how to fix the vulnerability.

## Changing vulnerability status

You can switch the status of a vulnerability using the **Status** dropdown to one of
the following values:

| Status    | Description                                                       |
|-----------|-------------------------------------------------------------------|
| Detected  | The default state for a newly discovered vulnerability            |
| Confirmed | A user has seen this vulnerability and confirmed it to be real    |
| Dismissed | A user has seen this vulnerability and dismissed it               |
| Resolved  | The vulnerability has been fixed and is no longer in the codebase |

## Creating an issue for a vulnerability

You can create an issue for a vulnerability by selecting the **Create issue** button.

This creates a [confidential issue](../../project/issues/confidential_issues.md) in the
project the vulnerability came from, and pre-populates it with useful information from
the vulnerability report. After the issue is created, GitLab redirects you to the
issue page so you can edit, assign, or comment on the issue.

## Automatic remediation solutions for vulnerabilities

You can fix some vulnerabilities by applying the solution that GitLab automatically
generates for you. GitLab supports the following scanners:

- [Dependency Scanning](../dependency_scanning/index.md): Automatic Patch creation
  is only available for Node.js projects managed with  `yarn`.
- [Container Scanning](../container_scanning/index.md).

When an automatic solution is available, the button in the header will show "Resolve with merge request":

![Resolve with Merge Request button](img/standalone_vulnerability_page_merge_request_button_v13_1.png)

Selecting the button will create a merge request with the automatic solution.

### Manually applying a suggested patch

To manually apply the patch that was generated by GitLab for a vulnerability, select the dropdown arrow on the "Resolve
with merge request" button, then select the "Download patch to resolve" option:

![Resolve with Merge Request button dropdown](img/standalone_vulnerability_page_merge_request_button_dropdown_v13_1.png)

This will change the button text to "Download patch to resolve". Click on it to download the patch:

![Download patch button](img/standalone_vulnerability_page_download_patch_button_v13_1.png)