How to add vulnerability for internal component

[iamrahul127]

Hi, I have gone through #96 and can see that, starting v 4.5.0 we have ability to add internal vulnerability. Problem is, even after giving "VULNERABILITY_MANAGEMENT" permission, user is not getting 'Create Vulnerability' button on the Vulnerabilities screen. Screen Shots as below.

1. Administrator has "VULNERABILITY_MANAGEMENT" permission.
   
2. User is part of Administrator team.
   
3. No "Create" button on Vulnerabilities screen.
   

[syalioune]

Hello @iamrahul127
It can be a session issue, the token generated by DT upon connection has a lifespan of 7d and contains the user permissions.
Can you try logout and login again ?

[iamrahul127]

Hi @syalioune, Yes I am aware of long token validity. I have tried log off and login several times.

Is there anything else I should be trying?

[syalioune]

That's odd. Can you check the permissions in the token after login ?
Just in case, you can retrieve it in your browser session storage and decode it using https://jwt.io/

[iamrahul127]

I see the permission included in token. Now it more strange.

{
"sub": "Rahul.Mahulkar",
"iss": "Dependency-Track",
"iat": 1668589499,
"exp": 1669194299,
"permissions": "ACCESS_MANAGEMENT,BOM_UPLOAD,POLICY_MANAGEMENT,POLICY_VIOLATION_ANALYSIS,PORTFOLIO_MANAGEMENT,PROJECT_CREATION_UPLOAD,SYSTEM_CONFIGURATION,VIEW_POLICY_VIOLATION,VIEW_PORTFOLIO,VIEW_VULNERABILITY,VULNERABILITY_ANALYSIS,VULNERABILITY_MANAGEMENT",
"idp": "OPENID_CONNECT"
}

[syalioune]

Maybe some kind of browser cache 😅 ?

[iamrahul127]

Tried in incognito mode and in chrome/Firefox but still not seeing the button. :) Is it a bug then?

[syalioune]

Either a bug or your frontend version is not correct.
@nscuro what do you think ?

[nscuro]

Checking the frontend version would by my next suggestion, yes. @iamrahul127, which version of DT are you using, and how did you deploy it?

[iamrahul127]

@nscuro I am using version 4.5.0. Screenshot as below.

I have installed it using helm chart. Chart details as below.

[nscuro]

Can you please click on the Dependency-Track link from your first screenshot? It will display the concrete versions of both API server and frontend. Version 1.4.0 of the chart you're using wrongly shipped frontend version 4.4.0 with API server 4.5.0, see https://github.com/evryfs/helm-charts/blob/dependency-track-1.4.0/charts/dependency-track/values.yaml#LL18C12-L18C12

[iamrahul127]

You are bang on target. Here you go.

I hope upgrading to latest version 1.5.4 will fix this issue.

[iamrahul127]

Upgrade to latest worked.