V
Vervain Anteater
The Checkmarx step only display and evaluate how many types of vulnerabilities identified by Checkmarx.
When I scan the project for the 1st time, I got 27 occurrences of SQL Injection: Java High Risk. Pipeline is failed because SQL injection is a new type of vulnerabilities for this pipeline.
https://app.harness.io/ng/account/vGS8Qq_fSJik8VyI4rwqHQ/ci/orgs/Corporate/projects/bus0011_INFOSEC/pipelines/Jeremy/executions/BlzR5TNlSMCm5c__pcPyTA/security?storeType=INLINE&pageSizeOccurrences=20&pageOccurrences=0&issue=M5GDsq9z9UIt1UeDtJnudr
The second time I run it, I got 28 occurrences of SQL Injection: Java High Risk. Pipeline is success because SQL Injection is an existing type of vulnerabilities.
https://app.harness.io/ng/account/vGS8Qq_fSJik8VyI4rwqHQ/ci/orgs/Corporate/projects/bus0011_INFOSEC/pipelines/Jeremy/executions/xYSS-ozVRXSpJfPAQrf3sw/security?storeType=INLINE&pageSizeOccurrences=20&pageOccurrences=0&issue=M5GDsq9z9UIt1UeDtJnudr
In case, the product team is introducing another new occurrence of SQL injection. Harness policy is not able to catch this new vulnerability as SQL injection type already exist.
October 18, 2023