fix: Check if vulnerability severity exists when calculating vulnerab…

…ility score (#80)
vaadin · Oct 12, 2023 · abb59f8 · abb59f8
1 parent f949a0d
commit abb59f8
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/appsec-kit-backend/src/main/java/com/vaadin/appsec/backend/AppSecDTOProvider.java b/appsec-kit-backend/src/main/java/com/vaadin/appsec/backend/AppSecDTOProvider.java
@@ -182,6 +182,9 @@ private static SeverityLevel findSeverityIfHigher(
 
     private static Double findScoreIfHigher(
             OpenSourceVulnerability vulnerability, Double highestScore) {
+        if (vulnerability.getSeverity() == null) {
+            return highestScore;
+        }
         Double hiScoreInVuln = vulnerability.getSeverity().stream()
                 .map(severity -> Cvss.fromVector(severity.getScore()))
                 .map(cvss -> cvss.calculateScore().getBaseScore())