Vulnerability Management Overview

Vulnerability management can detect Linux, Windows, Web-CMS, and application vulnerabilities and provide suggestions, helping you learn about server vulnerabilities in real time. Linux and Windows vulnerabilities can be fixed in one-click mode. This section describes how the vulnerabilities are detected and the vulnerabilities that can be scanned and fixed in each HSS edition.

Note

The vulnerability list displays vulnerabilities detected in the last seven days. After a vulnerability is detected for a server, if you change the server name and do not perform a vulnerability scan again, the vulnerability list still displays the original server name.

How Vulnerability Scan Works

Table 1 describes how different types of vulnerabilities are detected.

Table 1 How vulnerability scan works

Type

Mechanism

Linux vulnerability

Based on the vulnerability database, checks and handles vulnerabilities in the software (such as kernel, OpenSSL, vim, glibc) you obtained from official Linux sources and have not compiled, reports the results to the management console, and generates alarms.

Windows vulnerability

Synchronizes Microsoft official patches, checks whether the patches on the server have been updated, pushes Microsoft official patches, reports the results to the management console, and generates vulnerability alarms.

Web-CMS vulnerability

Checks web directories and files for Web-CMS vulnerabilities, reports the results to the management console, and generates vulnerability alarms.

Application vulnerability

HSS detects the vulnerabilities in the software and dependency packages running on servers and container server machines, reports risky vulnerabilities to the console, and displays vulnerability alarms.

Types of Vulnerabilities That Can Be Scanned and Fixed

For details about the types of vulnerabilities that can be scanned and fixed in different HSS editions, see Types of vulnerabilities that can be scanned and fixed in each HSS edition.

The meanings of the symbols in the table are as follows:

  • Y: supported

  • x: not supported

Table 2 Types of vulnerabilities that can be scanned and fixed in each HSS edition

Vulnerability Type

Function

Enterprise Edition

Premium Edition

Web Tamper Protection Edition

Container Edition

Linux vulnerability

Automatic vulnerability scan (reporting based on the software asset collection period)

Y

Y

Y

Y

Scheduled vulnerability scan (By default, vulnerabilities are scanned once a week. You can change the scan period by configuring vulnerability policies.)

Y

Y

Y

Y

Vulnerability whitelist

Y

Y

Y

Y

Manual vulnerability scan

Y

Y

Y

Y

One-click vulnerability fix

Y

(A maximum of 50 vulnerabilities can be fixed at a time.)

Y

Y

Y

Windows vulnerability

Automatic vulnerability scan (reporting based on the software asset collection period)

Y

Y

Y

x

Scheduled vulnerability scan (By default, vulnerabilities are scanned once a week. You can change the scan period by configuring vulnerability policies.)

Y

Y

Y

x

Vulnerability whitelist

Y

Y

Y

x

Manual vulnerability scan

Y

Y

Y

x

One-click vulnerability fix

Y

(A maximum of 50 vulnerabilities can be fixed at a time.)

Y

Y

x

Web-CMS vulnerability

Automatic vulnerability scan (reporting based on the software asset collection period)

Y

Y

Y

Y

Scheduled vulnerability scan (By default, vulnerabilities are scanned once a week. You can change the scan period by configuring vulnerability policies.)

Y

Y

Y

Y

Vulnerability whitelist

Y

Y

Y

Y

Manual vulnerability scan

Y

Y

Y

Y

One-click vulnerability fix

x

x

x

x

Application vulnerability

Automatic vulnerability scan (reporting based on the middleware asset collection period)

Y

Y

Y

Y

Scheduled vulnerability scan (By default, vulnerabilities are scanned once a week. You can change the scan period by configuring vulnerability policies.)

Y

Y

Y

Y

Vulnerability whitelist

Y

Y

Y

Y

Manual vulnerability scan

Y

Y

Y

Y

One-click vulnerability fix

x

x

x

x

Note

HSS can scan for Web-CMS and application vulnerabilities but cannot fix them. You can log in to your server to manually fix the vulnerability by referring to the suggestions displayed on the vulnerability details page.

last updated: 2024-11-13 14:56 UTC - commit: 5a24b83d79f89c6961ca080f765a6ba0043bab85