Skip to content

Commit b183e48

Browse files
ZacgooseZacgoose
committed
fix(cve-report): scope cache query by tenant
Update `Get-CIPPCVEReport` to query `DefenderCVEs` with the provided `$TenantFilter` instead of always using `allTenants`. For single-tenant requests, it now resolves tenant metadata via `Get-Tenants -TenantFilter` and uses the returned CVE set directly, removing redundant per-item customer ID filtering. This aligns report output and exception matching with the requested tenant context.
1 parent 012e8d1 commit b183e48

1 file changed

Lines changed: 70 additions & 62 deletions

File tree

‎Modules/CIPPCore/Public/Get-CIPPCVEReport.ps1‎

Lines changed: 70 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,10 @@ function Get-CIPPCVEReport {
1919
try {
2020
# Retrieve Exceptions from Exception database
2121
$CveExceptionsTable = Get-CIPPTable -TableName 'CveExceptions'
22-
$AllExceptions = Get-CIPPAzDataTableEntity @CveExceptionsTable
23-
$ExceptionsByCve = @{}
22+
$AllExceptions = Get-CIPPAzDataTableEntity @CveExceptionsTable
23+
$ExceptionsByCve = @{}
2424

25-
# Retrieve CVEs from database
26-
$RawCveData = Get-CIPPDbItem -TenantFilter 'allTenants' -Type 'DefenderCVEs' | Where-Object { $_.RowKey -ne 'DefenderCVEs-Count' }
25+
$RawCveData = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'DefenderCVEs' | Where-Object { $_.RowKey -ne 'DefenderCVEs-Count' }
2726
$AllCachedCves = $RawCveData.Data | ConvertFrom-Json
2827

2928
# Filter results by Tenant
@@ -37,13 +36,10 @@ function Get-CIPPCVEReport {
3736
[void]$RawCveItems.Add($Item)
3837
}
3938
}
40-
} else {
41-
$TenantList = Get-Tenants | Where-Object defaultDomainName -eq $TenantFilter
42-
foreach ($Item in $AllCachedCves) {
43-
if ($Item.customerId -eq $TenantFilter) {
44-
[void]$RawCveItems.Add($Item)
45-
}
46-
}
39+
}
40+
else {
41+
$TenantList = Get-Tenants -TenantFilter $TenantFilter
42+
$RawCveItems.AddRange(@($AllCachedCves))
4743
}
4844

4945
if ($RawCveItems.Count -eq 0) {
@@ -52,21 +48,21 @@ function Get-CIPPCVEReport {
5248

5349
# Build filtered exception items
5450
foreach ($Ex in $AllExceptions) {
55-
if ($TenantList.defaultDomainName -contains $Ex.customerId -or $Ex.customerId -eq 'ALL'){
51+
if ($TenantList.defaultDomainName -contains $Ex.customerId -or $Ex.customerId -eq 'ALL') {
5652
if (-not $ExceptionsByCve.ContainsKey($Ex.cveId)) {
5753
$ExceptionsByCve[$Ex.cveId] = [System.Collections.Generic.List[object]]::new()
5854
}
5955

6056
[void]$ExceptionsByCve[$Ex.cveId].Add([PSCustomObject]@{
61-
cveId = $Ex.cveId
62-
customerId = $Ex.customerId
63-
exceptionType = $Ex.exceptionType
64-
exceptionSource = $Ex.exceptionSource
65-
exceptionComment = $Ex.exceptionComment
66-
exceptionCreatedBy = $Ex.exceptionCreatedBy
67-
exceptionDate = $Ex.exceptionReadableDate
68-
exceptionExpiry = $Ex.exceptionExpiry
69-
})
57+
cveId = $Ex.cveId
58+
customerId = $Ex.customerId
59+
exceptionType = $Ex.exceptionType
60+
exceptionSource = $Ex.exceptionSource
61+
exceptionComment = $Ex.exceptionComment
62+
exceptionCreatedBy = $Ex.exceptionCreatedBy
63+
exceptionDate = $Ex.exceptionReadableDate
64+
exceptionExpiry = $Ex.exceptionExpiry
65+
})
7066
}
7167
}
7268

@@ -105,12 +101,18 @@ function Get-CIPPCVEReport {
105101
if ($Item.deviceDetailsJson) {
106102
$Devices = ConvertFrom-Json $Item.deviceDetailsJson | Sort-Object -Property deviceName -Unique
107103
foreach ($Dev in $Devices) {
108-
[void]$CveGroup.AffectedDevicesList.Add(@{ deviceName = $Dev.deviceName })
109-
if($Dev.registryPaths){[void]$CveGroup.RegistryPathList.Add(@{ deviceName = $Dev.deviceName
110-
registryPaths = $Dev.registryPaths })}
111-
if($Dev.diskPaths){[void]$CveGroup.DiskPathList.Add(@{ deviceName = $Dev.deviceName
112-
diskPaths = $Dev.diskPaths })}
113-
$CveGroup.TotalDeviceCount ++
104+
[void]$CveGroup.AffectedDevicesList.Add(@{ deviceName = $Dev.deviceName })
105+
if ($Dev.registryPaths) {
106+
[void]$CveGroup.RegistryPathList.Add(@{ deviceName = $Dev.deviceName
107+
registryPaths = $Dev.registryPaths
108+
})
109+
}
110+
if ($Dev.diskPaths) {
111+
[void]$CveGroup.DiskPathList.Add(@{ deviceName = $Dev.deviceName
112+
diskPaths = $Dev.diskPaths
113+
})
114+
}
115+
$CveGroup.TotalDeviceCount ++
114116
}
115117
}
116118
}
@@ -129,49 +131,55 @@ function Get-CIPPCVEReport {
129131
$ExceptionDate = ''
130132
$ExceptionExpiry = ''
131133

132-
if ($ExceptionsByCve.ContainsKey($CveKey)){
133-
$Exceptions = @($ExceptionsByCve[$CveKey])
134-
$HasException = $true
135-
$ExceptionStatus = if ($Exceptions.customerId -contains "ALL") { "All" } else { "Partial" }
136-
$ExceptionType = @{ customerId = $Exceptions.customerId
137-
exceptionType = $Exceptions.exceptionType }
138-
$ExceptionComment = @{ customerId = $Exceptions.customerId
139-
exceptionComment = $Exceptions.exceptionComment }
134+
if ($ExceptionsByCve.ContainsKey($CveKey)) {
135+
$Exceptions = @($ExceptionsByCve[$CveKey])
136+
$HasException = $true
137+
$ExceptionStatus = if ($Exceptions.customerId -contains "ALL") { "All" } else { "Partial" }
138+
$ExceptionType = @{ customerId = $Exceptions.customerId
139+
exceptionType = $Exceptions.exceptionType
140+
}
141+
$ExceptionComment = @{ customerId = $Exceptions.customerId
142+
exceptionComment = $Exceptions.exceptionComment
143+
}
140144
$ExceptionCreatedBy = @{ customerId = $Exceptions.customerId
141-
exceptionCreatedBy = $Exceptions.exceptionCreatedBy }
142-
$ExceptionDate = @{ customerId = $Exceptions.customerId
143-
exceptionDate = $Exceptions.exceptionDate }
144-
$ExceptionExpiry = @{ customerId = $Exceptions.customerId
145-
exceptionExpiry = $Exceptions.exceptionExpiry }
145+
exceptionCreatedBy = $Exceptions.exceptionCreatedBy
146+
}
147+
$ExceptionDate = @{ customerId = $Exceptions.customerId
148+
exceptionDate = $Exceptions.exceptionDate
149+
}
150+
$ExceptionExpiry = @{ customerId = $Exceptions.customerId
151+
exceptionExpiry = $Exceptions.exceptionExpiry
152+
}
146153
}
147154

148155
[void]$SortedCves.Add([PSCustomObject]@{
149-
cveId = $Target.cveId
150-
vulnerabilitySeverityLevel = $Target.vulnerabilitySeverityLevel
151-
exploitabilityLevel = $Target.exploitabilityLevel
152-
softwareName = $Target.softwareName
153-
softwareVendor = $Target.softwareVendor
154-
softwareVersion = $Target.softwareVersion
155-
deviceCount = $Target.TotalDeviceCount
156-
tenantCount = $Target.TotalTenantGroupCount
157-
registryPaths = $Target.RegistryPathList
158-
diskPaths = $Target.DiskPathList
159-
exceptionStatus = $ExceptionStatus
160-
hasException = $HasException
161-
affectedTenants = $Target.AffectedTenantsList
162-
affectedDevices = $Target.AffectedDevicesList
163-
exceptionType = $ExceptionType
164-
exceptionComment = $ExceptionComment
165-
exceptionCreatedBy = $ExceptionCreatedBy
166-
exceptionDate = $ExceptionDate
167-
exceptionExpiry = $ExceptionExpiry
168-
cacheTimeStamp = $Target.lastUpdated
169-
})
156+
cveId = $Target.cveId
157+
vulnerabilitySeverityLevel = $Target.vulnerabilitySeverityLevel
158+
exploitabilityLevel = $Target.exploitabilityLevel
159+
softwareName = $Target.softwareName
160+
softwareVendor = $Target.softwareVendor
161+
softwareVersion = $Target.softwareVersion
162+
deviceCount = $Target.TotalDeviceCount
163+
tenantCount = $Target.TotalTenantGroupCount
164+
registryPaths = $Target.RegistryPathList
165+
diskPaths = $Target.DiskPathList
166+
exceptionStatus = $ExceptionStatus
167+
hasException = $HasException
168+
affectedTenants = $Target.AffectedTenantsList
169+
affectedDevices = $Target.AffectedDevicesList
170+
exceptionType = $ExceptionType
171+
exceptionComment = $ExceptionComment
172+
exceptionCreatedBy = $ExceptionCreatedBy
173+
exceptionDate = $ExceptionDate
174+
exceptionExpiry = $ExceptionExpiry
175+
cacheTimeStamp = $Target.lastUpdated
176+
})
170177
}
171178

172179
return $SortedCves | Sort-Object -Property cveId
173180

174-
} catch {
181+
}
182+
catch {
175183
Write-LogMessage -API 'CVEReport' -tenant $TenantFilter -message "Failed to generate CVE report: $($_.Exception.Message)" -sev Error
176184
throw
177185
}

0 commit comments

Comments
 (0)