VulnLookup

Vulnerability Lookup

The Vulnerability Lookup module queries the CIRCL Vulnerability API to enrich CVE (Common Vulnerabilities and Exposures) identifiers with actionable intelligence, scoring metrics, and threat context.

Important

Data Attribution: All vulnerability metadata, CVE descriptions, CVSS scores, exploit links, publication dates, etc., extracted by this module are exclusively provided by CIRCL.

Configuration & Limits

This module can operate in two modes based on your configuration:

1. Unauthenticated: If no API key is provided, the module operates normally but is subject to stricter rate limits.
2. Authenticated: Providing a CIRCL API key in your API Credentials grants access to significantly higher rate limits.

In either case, you can tune the request delays and retry logic within your Network Configuration to optimize performance and handle rate-limit responses.

Caching & Optimization

The module implements cross-function shared caching to optimize API usage and prevent redundant requests:

• Shared CVE/CPE Cache: If a CVE has already been enriched via the enrich_circl_cve function, or if its full details were previously extracted during a search_circl_cpe lookup, subsequent requests for that exact CVE are safely skipped. The same logic applies to duplicate CPE queries. This ensures that no meaningless requests are made for entities that have already been parsed.

Capabilities

The module processes vulnerabilities through two primary pathways:

CVE Enrichment

The module accepts CVE nodes and extracts the following intelligence:

• Descriptions: Extracts the primary English summary and description of the vulnerability.
• CWE Classification: Extracts the underlying CWE (Common Weakness Enumeration) ID, along with a human-readable description of the weakness class.
• CPE Applicability: Extracts the CPE (Common Platform Enumeration) strings representing the vulnerable software or hardware configurations.
• CVSS Scoring: Extracts the best available Common Vulnerability Scoring System (CVSS) data, presenting the base score, severity, and vector string.
• EPSS Exploitation Probability: Extracts the Exploit Prediction Scoring System (EPSS) percentage and its percentile rank (RankEPSS), indicating the real-world likelihood of exploitation.
• Known Exploited Vulnerabilities (KEV): Checks if the CVE is present in the CISA KEV catalog and extracts the date it was added.
• SSVC Metrics: Extracts Stakeholder-Specific Vulnerability Categorization details, such as whether the vulnerability is "Automatable" or its current "Exploitation" status.
• Metadata: Extracts exploit links, publication dates, etc.

CPE Search

The module accepts CPE strings (e.g., cpe:2.3:a:nginx:nginx:1.24.0) and performs a reverse-lookup to discover associated vulnerabilities. To prevent overwhelmingly broad results and eliminate false positives, the module employs a two-stage filtering process:

1. Pre-flight Check: It only processes CPEs that specify an exact version; queries for CPEs with wildcards (*, -) or omitted versions are intentionally dropped before any requests are made.
2. Post-fetch Validation: Since upstream APIs often return overly broad results, the module parses the complex version range logic (e.g., <= or <) within each returned CVE's affected configurations. It rigorously verifies that the requested exact version mathematically falls within the vulnerable range, silently discarding any CVEs that do not genuinely affect the target.

When a verified match is found, it extracts the associated CVE Identifiers, linking them back to the input CPE. It then automatically processes each discovered vulnerability through the exact same CVE Enrichment pipeline described above, extracting all available intelligence (Descriptions, CVSS, EPSS, CWE, etc.) for every verified CVE.

Additionally, the module preserves the raw JSON responses from the CIRCL API, attaching them directly to the execution results for auditing and manual inspection.