{"id":78848,"date":"2026-10-03T17:40:46","date_gmt":"2026-10-03T17:40:46","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=78848"},"modified":"2026-10-03T17:40:51","modified_gmt":"2026-10-03T17:40:51","slug":"nvd-website-and-nvd-api-key-tutorial","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/nvd-website-and-nvd-api-key-tutorial\/","title":{"rendered":"NVD Website and NVD API Key Tutorial"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The <strong>National Vulnerability Database (NVD)<\/strong> is a vulnerability database maintained by the <strong>National Institute of Standards and Technology (NIST)<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NVD provides security information about publicly known vulnerabilities, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CVE identifiers<\/li>\n\n\n\n<li>Vulnerability descriptions<\/li>\n\n\n\n<li>CVSS severity scores<\/li>\n\n\n\n<li>Affected products<\/li>\n\n\n\n<li>CWE information<\/li>\n\n\n\n<li>References<\/li>\n\n\n\n<li>CPE information<\/li>\n\n\n\n<li>Vulnerability configurations<\/li>\n\n\n\n<li>Known vulnerability metadata<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">NVD is widely used by security tools such as <strong>OWASP Dependency-Check<\/strong> to identify vulnerable third-party software dependencies.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">2. What is NVD?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>NVD = National Vulnerability Database<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Official website:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/nvd.nist.gov\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The NVD provides information about publicly disclosed software and hardware vulnerabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, a vulnerability may have an identifier such as:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">CVE-2021-44228<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">This is the well-known Log4Shell vulnerability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can search for a CVE directly on the NVD website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">https:<span class=\"hljs-comment\">\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-44228<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">3. What is CVE?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Before understanding the NVD API, it is important to understand CVE.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVE = Common Vulnerabilities and Exposures<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A CVE identifier uniquely identifies a publicly known vulnerability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">CVE-2021-44228<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">The CVE record can contain information such as:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">CVE ID\nDescription\nAffected products\nCVSS score\nCWE\nReferences\nPublished date\nModified date<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">NVD enriches CVE information with additional security information.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">4. What is CVSS?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVSS = Common Vulnerability Scoring System<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVSS is used to describe the severity of a vulnerability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Typical severity categories are:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>CVSS Score<\/th><th>Severity<\/th><\/tr><tr><td>0.0<\/td><td>None<\/td><\/tr><tr><td>0.1\u20133.9<\/td><td>Low<\/td><\/tr><tr><td>4.0\u20136.9<\/td><td>Medium<\/td><\/tr><tr><td>7.0\u20138.9<\/td><td>High<\/td><\/tr><tr><td>9.0\u201310.0<\/td><td>Critical<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">CVSS = 9.8<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">generally indicates a critical-severity vulnerability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Important: CVSS is a severity measurement, not necessarily an indication of the actual risk in your specific environment.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">5. Exploring the NVD Website<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/nvd.nist.gov\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The NVD website provides several useful areas.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Commonly used sections include:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Vulnerabilities\nCVE\nCPE\nData Feeds\nDevelopers \/ API<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">For vulnerability research, the most commonly used functionality is the CVE search.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">6. Searching for a CVE<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Go to:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/nvd.nist.gov\/vuln\/search\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Search for:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">CVE-2021-44228<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">You can inspect information such as:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">CVE ID\nDescription\nCVSS\nWeakness\nConfigurations\nReferences<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">This is useful when manually investigating a vulnerability discovered by an SCA tool.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">7. What is the NVD API?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The NVD also provides programmatic access to vulnerability information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of manually opening the website, a security tool can communicate with NVD using an API.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Conceptually:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Security Tool\n     |\n     | HTTP API Request\n     v\nNVD API\n     |\n     v\nCVE Vulnerability Data<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">This allows security tools to automatically retrieve vulnerability information.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">8. Why Do Security Tools Use the NVD API?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a Java application with hundreds of dependencies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Application\n |\n +-- Spring\n |\n +-- Jackson\n |\n +-- Log4j\n |\n +-- Apache Commons\n |\n +-- Tomcat\n |\n +-- Other libraries<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Manually checking every dependency against NVD would be impractical.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An SCA tool can automate this process:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Source Code\n     |\n     v\nDependency Analysis\n     |\n     v\nIdentify Dependencies\n     |\n     v\nQuery Vulnerability Database\n     |\n     v\nNVD\n     |\n     v\nMatch CVEs\n     |\n     v\nGenerate Security Report<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">This is one of the reasons <strong>OWASP Dependency-Check<\/strong> uses NVD vulnerability information.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">9. What is an NVD API Key?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The <strong>NVD API key<\/strong> is a credential provided by NVD that allows applications to access the NVD API.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is used by tools such as:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">OWASP Dependency-Check\nSecurity scanners\nVulnerability management systems\nCustom security applications\nCI\/CD security pipelines<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">The API key helps NVD identify and manage API requests.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">10. Do You Always Need an NVD API Key?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Not every interaction with the NVD website requires an API key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, you can manually browse:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">https:<span class=\"hljs-comment\">\/\/nvd.nist.gov\/<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">without an API key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, automated tools that query the NVD API can benefit from an API key and may require one depending on the tool, API usage, rate limits, and configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For OWASP Dependency-Check, using an NVD API key is recommended for reliable and efficient NVD updates.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">11. Requesting an NVD API Key<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Open the official NVD API key request page:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/nvd.nist.gov\/developers\/request-an-api-key\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Follow the instructions provided by NVD.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, you provide information such as:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Organization\nEmail address\nOrganization type<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Then submit the request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NVD will provide instructions for activating\/obtaining the API key.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">12. Important: Protect Your API Key<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Treat the NVD API key like a credential.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do NOT put it directly into:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">GitHub repositories\n<span class=\"hljs-keyword\">Public<\/span> scripts\nDocker images\n<span class=\"hljs-keyword\">Public<\/span> documentation\nScreenshots<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">For example, avoid:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-4\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">dependency-check<\/span><span class=\"hljs-selector-class\">.sh<\/span> <span class=\"hljs-selector-tag\">--nvdApiKey<\/span> 75<span class=\"hljs-selector-tag\">C90-XXXXXXXX-CB64<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-4\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">when sharing terminal screenshots publicly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead, use an environment variable.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">13. Setting the NVD API Key as an Environment Variable<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Linux\/macOS:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-5\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\"><span class=\"hljs-keyword\">export<\/span> NVD_API_KEY=<span class=\"hljs-string\">\"YOUR_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-5\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Verify that it exists:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-6\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-keyword\">echo<\/span> <span class=\"hljs-string\">\"$NVD_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-6\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">For security, avoid displaying the actual key when recording a tutorial.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can check whether it is set:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-7\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-keyword\">if<\/span> &#91; -n <span class=\"hljs-string\">\"$NVD_API_KEY\"<\/span> ]; then\n    <span class=\"hljs-keyword\">echo<\/span> <span class=\"hljs-string\">\"NVD API key is configured\"<\/span>\n<span class=\"hljs-keyword\">else<\/span>\n    <span class=\"hljs-keyword\">echo<\/span> <span class=\"hljs-string\">\"NVD API key is not configured\"<\/span>\nfi<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-7\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">14. Testing the NVD API<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The NVD API provides a CVE API endpoint.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-8\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">https:<span class=\"hljs-comment\">\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-8\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">You can test access using <code>curl<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-9\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">curl \\\n  -H <span class=\"hljs-string\">\"apiKey: $NVD_API_KEY\"<\/span> \\\n  <span class=\"hljs-string\">\"https:\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0?resultsPerPage=1\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-9\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">The API should return JSON data.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">15. Understanding the API Response<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The response is JSON.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Conceptually, it contains information similar to:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-10\" data-shcb-language-name=\"JSON \/ JSON with Comments\" data-shcb-language-slug=\"json\"><span><code class=\"hljs language-json\">{\n  <span class=\"hljs-attr\">\"resultsPerPage\"<\/span>: <span class=\"hljs-number\">1<\/span>,\n  <span class=\"hljs-attr\">\"startIndex\"<\/span>: <span class=\"hljs-number\">0<\/span>,\n  <span class=\"hljs-attr\">\"totalResults\"<\/span>: <span class=\"hljs-number\">1<\/span>,\n  <span class=\"hljs-attr\">\"vulnerabilities\"<\/span>: &#91;\n    {\n      <span class=\"hljs-attr\">\"cve\"<\/span>: {\n        <span class=\"hljs-attr\">\"id\"<\/span>: <span class=\"hljs-string\">\"CVE-XXXX-XXXXX\"<\/span>,\n        <span class=\"hljs-attr\">\"descriptions\"<\/span>: &#91;],\n        <span class=\"hljs-attr\">\"metrics\"<\/span>: {},\n        <span class=\"hljs-attr\">\"references\"<\/span>: &#91;]\n      }\n    }\n  ]\n}<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-10\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JSON \/ JSON with Comments<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">json<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">The exact response structure can vary depending on the API request and available vulnerability information.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">16. NVD API and OWASP Dependency-Check<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">OWASP Dependency-Check can use NVD vulnerability information to identify vulnerabilities in application dependencies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The workflow is approximately:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Java Application\n       |\n       v\npom.xml\n       |\n       v\nDependency-Check\n       |\n       v\nDependency Identification\n       |\n       v\nNVD API\n       |\n       v\nCVE Information\n       |\n       v\nVulnerability Matching\n       |\n       v\nDependency-Check Report<\/code><\/span><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">17. Configure NVD API Key for Dependency-Check<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">If you are using the Dependency-Check CLI:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-11\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">dependency-check.sh \\\n  --project <span class=\"hljs-string\">\"My Application\"<\/span> \\\n  --scan . \\\n  --nvdApiKey <span class=\"hljs-string\">\"$NVD_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-11\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">On Windows:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-12\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">dependency-check.bat ^\n  --project <span class=\"hljs-string\">\"My Application\"<\/span> ^\n  --scan . ^\n  --nvdApiKey <span class=\"hljs-string\">\"%NVD_API_KEY%\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-12\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">18. Maven Configuration<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">If you use the OWASP Dependency-Check Maven plugin, you can pass the API key using an environment variable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-13\" data-shcb-language-name=\"HTML, XML\" data-shcb-language-slug=\"xml\"><span><code class=\"hljs language-xml\"><span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">plugin<\/span>&gt;<\/span>\n    <span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">groupId<\/span>&gt;<\/span>org.owasp<span class=\"hljs-tag\">&lt;\/<span class=\"hljs-name\">groupId<\/span>&gt;<\/span>\n    <span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">artifactId<\/span>&gt;<\/span>dependency-check-maven<span class=\"hljs-tag\">&lt;\/<span class=\"hljs-name\">artifactId<\/span>&gt;<\/span>\n    <span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">version<\/span>&gt;<\/span>YOUR_VERSION<span class=\"hljs-tag\">&lt;\/<span class=\"hljs-name\">version<\/span>&gt;<\/span>\n\n    <span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">configuration<\/span>&gt;<\/span>\n        <span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">nvdApiKey<\/span>&gt;<\/span>${env.NVD_API_KEY}<span class=\"hljs-tag\">&lt;\/<span class=\"hljs-name\">nvdApiKey<\/span>&gt;<\/span>\n    <span class=\"hljs-tag\">&lt;\/<span class=\"hljs-name\">configuration<\/span>&gt;<\/span>\n<span class=\"hljs-tag\">&lt;\/<span class=\"hljs-name\">plugin<\/span>&gt;<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-13\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">HTML, XML<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">xml<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Then:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-14\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\"><span class=\"hljs-keyword\">export<\/span> NVD_API_KEY=<span class=\"hljs-string\">\"YOUR_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-14\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-15\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">mvn<\/span> <span class=\"hljs-selector-tag\">dependency-check<\/span><span class=\"hljs-selector-pseudo\">:check<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-15\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">This approach prevents the actual API key from being hard-coded in <code>pom.xml<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">19. GitHub Actions<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">For CI\/CD, do not hard-code the API key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Store it as a GitHub Actions secret.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Go to:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-16\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">GitHub Repository\n    \u2193\nSettings\n    \u2193\nSecrets <span class=\"hljs-keyword\">and<\/span> variables\n    \u2193\nActions\n    \u2193\n<span class=\"hljs-keyword\">New<\/span> repository secret<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-16\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Use:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Name:\nNVD_API_KEY\n\nValue:\nYour NVD API key<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Then use it in GitHub Actions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-17\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">name: Dependency Check\n\n<span class=\"hljs-attr\">on<\/span>:\n  push:\n  pull_request:\n\njobs:\n  dependency-check:\n    runs-on: ubuntu-latest\n\n    <span class=\"hljs-attr\">steps<\/span>:\n      - name: Checkout\n        <span class=\"hljs-attr\">uses<\/span>: actions\/checkout@v4\n\n      - name: Run OWASP Dependency-Check\n        <span class=\"hljs-attr\">uses<\/span>: dependency-check\/Dependency-Check_Action@main\n        <span class=\"hljs-attr\">with<\/span>:\n          project: <span class=\"hljs-string\">\"My Application\"<\/span>\n          <span class=\"hljs-attr\">path<\/span>: <span class=\"hljs-string\">\".\"<\/span>\n          <span class=\"hljs-attr\">format<\/span>: <span class=\"hljs-string\">\"HTML\"<\/span>\n          <span class=\"hljs-attr\">args<\/span>: &gt;\n            --nvdApiKey ${{ secrets.NVD_API_KEY }}\n\n      - name: Upload Dependency-Check Report\n        <span class=\"hljs-attr\">uses<\/span>: actions\/upload-artifact@v4\n        <span class=\"hljs-attr\">with<\/span>:\n          name: dependency-check-report\n          <span class=\"hljs-attr\">path<\/span>: reports\/<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-17\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Always verify the current Dependency-Check GitHub Action documentation before using a specific action version in production.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">20. Common NVD API Key Error<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">A common error is:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-18\" data-shcb-language-name=\"HTTP\" data-shcb-language-slug=\"http\"><span><code class=\"hljs language-http\"><span class=\"hljs-attribute\">NvdApiException<\/span>: Invalid API Key<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-18\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">HTTP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">http<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-19\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">&#91;ERROR] <span class=\"hljs-built_in\">Error<\/span> updating the NVD Data\n\nCaused by:\nNvdApiException: Invalid API Key<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-19\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">This generally means that the API key being supplied to Dependency-Check is not being accepted by the NVD API.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">21. Troubleshooting Invalid API Key<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1 \u2014 Check the key<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Make sure you are using the correct current key.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-20\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-keyword\">echo<\/span> <span class=\"hljs-string\">\"$NVD_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-20\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Do not publish the output.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2 \u2014 Test the API directly<\/h3>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-21\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">curl \\\n  -H <span class=\"hljs-string\">\"apiKey: $NVD_API_KEY\"<\/span> \\\n  <span class=\"hljs-string\">\"https:\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0?resultsPerPage=1\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-21\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">If the API returns an invalid-key response, investigate the NVD key itself.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the direct API call works but Dependency-Check fails, investigate the Dependency-Check configuration and version.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3 \u2014 Check the environment variable<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-22\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-keyword\">if<\/span> &#91; -z <span class=\"hljs-string\">\"$NVD_API_KEY\"<\/span> ]; then\n    <span class=\"hljs-keyword\">echo<\/span> <span class=\"hljs-string\">\"NVD_API_KEY is not set\"<\/span>\n<span class=\"hljs-keyword\">else<\/span>\n    <span class=\"hljs-keyword\">echo<\/span> <span class=\"hljs-string\">\"NVD_API_KEY is set\"<\/span>\nfi<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-22\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4 \u2014 Check for accidental spaces<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An API key copied with leading\/trailing spaces can cause problems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-23\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\"><span class=\"hljs-keyword\">export<\/span> NVD_API_KEY=<span class=\"hljs-string\">\" YOUR_API_KEY \"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-23\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">use:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-24\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\"><span class=\"hljs-keyword\">export<\/span> NVD_API_KEY=<span class=\"hljs-string\">\"YOUR_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-24\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">22. NVD API Without Hard-Coding Credentials<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Bad practice:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-25\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">dependency-check.sh \\\n  --nvdApiKey <span class=\"hljs-string\">\"YOUR_REAL_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-25\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Better:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-26\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\"><span class=\"hljs-keyword\">export<\/span> NVD_API_KEY=<span class=\"hljs-string\">\"YOUR_REAL_API_KEY\"<\/span>\n\ndependency-check.sh \\\n  --nvdApiKey <span class=\"hljs-string\">\"$NVD_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-26\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Best practice in CI\/CD:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">GitHub Secret\n      |\n      v\nGitHub Actions\n      |\n      v\nEnvironment\/CLI argument\n      |\n      v\nDependency-Check\n      |\n      v\nNVD API<\/code><\/span><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">23. NVD API and Rate Limiting<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The NVD API has request-rate considerations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If many applications or CI\/CD jobs continuously request NVD data, unnecessary API calls can create problems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use an API key where appropriate.<\/li>\n\n\n\n<li>Avoid unnecessary repeated database updates.<\/li>\n\n\n\n<li>Cache vulnerability data where your tool supports it.<\/li>\n\n\n\n<li>Avoid running full vulnerability database updates unnecessarily.<\/li>\n\n\n\n<li>Configure CI\/CD jobs carefully.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">24. NVD API 2.0<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Modern NVD integrations use the <strong>NVD API 2.0<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The CVE API endpoint is:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-27\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">https:<span class=\"hljs-comment\">\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-27\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-28\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">curl \\\n  -H <span class=\"hljs-string\">\"apiKey: $NVD_API_KEY\"<\/span> \\\n  <span class=\"hljs-string\">\"https:\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0?resultsPerPage=5\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-28\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">The API can be queried using parameters to retrieve specific vulnerability information.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">25. Practical Lab<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Objective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In this lab you will:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Open the NVD website.<\/li>\n\n\n\n<li>Search for a CVE.<\/li>\n\n\n\n<li>Request an NVD API key.<\/li>\n\n\n\n<li>Configure the API key.<\/li>\n\n\n\n<li>Test the NVD API.<\/li>\n\n\n\n<li>Configure OWASP Dependency-Check.<\/li>\n\n\n\n<li>Run a vulnerability scan.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1 \u2014 Open NVD<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-29\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">https:<span class=\"hljs-comment\">\/\/nvd.nist.gov\/<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-29\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Explore:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Vulnerabilities\nCVE\nCPE\nDevelopers<\/code><\/span><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2 \u2014 Search for a CVE<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Search:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">CVE-2021-44228<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Review:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">CVE ID\nDescription\nCVSS\nWeakness\nConfigurations\nReferences<\/code><\/span><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3 \u2014 Request an API Key<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-30\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">https:<span class=\"hljs-comment\">\/\/nvd.nist.gov\/developers\/request-an-api-key<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-30\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Complete the NVD API key request process.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4 \u2014 Configure the Key<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">macOS\/Linux:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-31\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\"><span class=\"hljs-keyword\">export<\/span> NVD_API_KEY=<span class=\"hljs-string\">\"YOUR_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-31\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-32\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-keyword\">if<\/span> &#91; -n <span class=\"hljs-string\">\"$NVD_API_KEY\"<\/span> ]; then\n    <span class=\"hljs-keyword\">echo<\/span> <span class=\"hljs-string\">\"API key configured\"<\/span>\nfi<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-32\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5 \u2014 Test the API<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-33\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">curl \\\n  -H <span class=\"hljs-string\">\"apiKey: $NVD_API_KEY\"<\/span> \\\n  <span class=\"hljs-string\">\"https:\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0?resultsPerPage=1\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-33\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p class=\"wp-block-paragraph\">Confirm that the API returns JSON.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6 \u2014 Run Dependency-Check<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-34\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">dependency-check.sh \\\n  --project <span class=\"hljs-string\">\"NVD Lab\"<\/span> \\\n  --scan . \\\n  --nvdApiKey <span class=\"hljs-string\">\"$NVD_API_KEY\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-34\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 7 \u2014 Review the Report<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open the generated Dependency-Check report.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Look for:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Dependencies\nVulnerabilities\nCVE\nCVSS\nSeverity\nEvidence\nReferences<\/code><\/span><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">26. Complete Security Data Flow<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The complete SCA flow can be represented as:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>               Developer\n                    |\n                    v\n              Source Code\n                    |\n                    v\n             pom.xml\/package.json\n                    |\n                    v\n          OWASP Dependency-Check\n                    |\n                    v\n          Identify Dependencies\n                    |\n                    v\n               NVD API\n                    |\n             NVD API Key\n                    |\n                    v\n             NVD CVE Data\n                    |\n                    v\n          Vulnerability Matching\n                    |\n                    v\n             SCA Report\n                    |\n                    v\n          Developer \/ Security Team<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">27. NVD Website vs NVD API<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>Feature<\/th><th>NVD Website<\/th><th>NVD API<\/th><\/tr><tr><td>Manual CVE search<\/td><td>Yes<\/td><td>Yes<\/td><\/tr><tr><td>Human-friendly interface<\/td><td>Yes<\/td><td>No<\/td><\/tr><tr><td>Automated access<\/td><td>Limited<\/td><td>Yes<\/td><\/tr><tr><td>JSON data<\/td><td>No\/limited<\/td><td>Yes<\/td><\/tr><tr><td>CI\/CD integration<\/td><td>Indirect<\/td><td>Yes<\/td><\/tr><tr><td>Security automation<\/td><td>Limited<\/td><td>Yes<\/td><\/tr><tr><td>Tool integration<\/td><td>Indirect<\/td><td>Yes<\/td><\/tr><tr><td>API key<\/td><td>Not required for normal browsing<\/td><td>Used for API access<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">28. Important Security Practices<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Follow these practices when using an NVD API key:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-35\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-keyword\">Do<\/span> not commit the key to Git\n<span class=\"hljs-keyword\">Do<\/span> not publish the key in tutorials\n<span class=\"hljs-keyword\">Do<\/span> not put the key in screenshots\n<span class=\"hljs-keyword\">Do<\/span> not put the key directly into <span class=\"hljs-keyword\">public<\/span> YAML files\n<span class=\"hljs-keyword\">Do<\/span> not share the key with other people\n<span class=\"hljs-keyword\">Use<\/span> <span class=\"hljs-title\">GitHub<\/span> <span class=\"hljs-title\">Secrets<\/span> <span class=\"hljs-title\">for<\/span> <span class=\"hljs-title\">CI<\/span>\/<span class=\"hljs-title\">CD<\/span>\n<span class=\"hljs-title\">Use<\/span> <span class=\"hljs-title\">environment<\/span> <span class=\"hljs-title\">variables<\/span> <span class=\"hljs-title\">for<\/span> <span class=\"hljs-title\">local<\/span> <span class=\"hljs-title\">testing<\/span>\n<span class=\"hljs-title\">Rotate<\/span>\/<span class=\"hljs-title\">reissue<\/span> <span class=\"hljs-title\">credentials<\/span> <span class=\"hljs-title\">when<\/span> <span class=\"hljs-title\">necessary<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-35\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">29. Key Takeaways<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Remember these five concepts:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">NVD\n \u2193\nNational Vulnerability Database\n\nCVE\n \u2193\nUnique vulnerability identifier\n\nCVSS\n \u2193\nVulnerability severity scoring system\n\nNVD API\n \u2193\nProgrammatic access to NVD vulnerability data\n\nNVD API Key\n \u2193\nCredential used when accessing the NVD API<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">The overall SCA relationship is:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Application\n    \u2193\nDependencies\n    \u2193\nOWASP Dependency-Check\n    \u2193\nNVD API\n    \u2193\nCVE Database\n    \u2193\nVulnerability Detection\n    \u2193\nSecurity Report<\/code><\/span><\/pre>\n\n\n<p class=\"wp-block-paragraph\">This makes the <strong>NVD API an important component of an automated Software Composition Analysis workflow<\/strong>, particularly when using tools such as OWASP Dependency-Check.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction The National Vulnerability Database (NVD) is a vulnerability database maintained by the National Institute of Standards and Technology (NIST). NVD provides security information about publicly&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-78848","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=78848"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78848\/revisions"}],"predecessor-version":[{"id":78849,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78848\/revisions\/78849"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=78848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=78848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=78848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}