Tenable Plugin Attributes

Detailed plugin information returned by the GET /plugins/plugin endpoint includes the following attributes:

Attribute	Type	Description
plugin_modification_date	string	The date when Tenable last updated the plugin.
plugin_version	string	The version of the plugin.
exploited_by_malware	boolean	Indicates whether the vulnerability discovered by this plugin is known to be exploited by malware.
description	string	The extended description of the plugin.
unsupported_by_vendor	boolean	Indicates whether the software found by this plugin is unsupported by the software's vendor (for example, Windows 95 or Firefox 3).
cvss_temporal_score	float	The raw CVSSv2 temporal metrics for the vulnerability.
cvss_temporal_vector	object	The raw CVSSv2 temporal metrics for the vulnerability. For more information, see CVSSv2 documentation.
patch_publication_date	string	The date when the vendor published a patch for the vulnerability.
see_also	array	Links to external websites that contain helpful information about the vulnerability.
default_account	string	Indicates whether the plugin checks for default accounts requiring the use of credentials other than the credentials provided in the scan policy. For more information, see What are the plugins that test for default accounts? in the Tenable Community Portal.
exploit_available	boolean	Indicates whether a known public exploit exists for the vulnerability.
cve	array	A list of Common Vulnerabilities and Exposures (CVE) IDs for vulnerabilities associated with the plugin.
exploit_framework_canvas	boolean	Indicates whether an exploit exists in the Immunity CANVAS framework.
cvss_base_score	float	The CVSSv2 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments).
solution	string	Remediation information for the vulnerability.
cvss_vector	object	The raw CVSSv2 metrics for the vulnerability. For more information, see CVSSv2 documentation.
cvss_score_source	string	The source of the CVSSv2 score. This is the CVE that the score is derived from, for example CVE-2021-44228, or `manual` if Tenable assigned the score directly.
cvss_score_rationale	string	The reason Tenable assigned the score directly rather than deriving it. Only plugins with a manually assigned score include this attribute.
exploit_framework_exploithub	boolean	Indicates whether an exploit exists in the ExploitHub framework.
cpe	array	A list of plugin target systems identified by Common Platform Enumeration (CPE).
plugin_publication_date	string	The date when Tenable originally published the plugin.
exploit_framework_core	boolean	Indicates whether an exploit exists in the CORE Impact framework.
in_the_news	boolean	Indicates whether this plugin has received media attention (for example, ShellShock, Meltdown).
has_patch	boolean	Indicates whether the vendor has published a patch for the vulnerability. This attribute is `true` if there is a published patch for the vulnerability (that is, the patch_publication_date attribute contains data) and `false` if there is no published patch or a patch is not relevant to remediating the vulnerability (that is, patch_publication_date does not contain data).
xref	array	References to third-party information about the vulnerability, exploit, or update associated with the plugin presented as an array of strings. Each reference includes a type, for example, 'FEDORA', and an ID, for example, '2003-047'.
malware	boolean	Indicates whether the plugin targets potentially malicious files or processes.
exploit_framework_d2_elliot	boolean	Indicates an exploit exists in the D2 Elliot Web Exploitation framework
xrefs	array	References to third-party information about the vulnerability, exploit, or update associated with the plugin presented as an array of objects. Each reference includes a type, for example, 'FEDORA', and an ID, for example, '2003-047'.
risk_factor	string	The risk factor associated with the plugin, based on the CVSS score of the vulnerability: NONE (the plugin has no CVSS score), LOW (0.1 to 3.9), MEDIUM (4.0 to 6.9), HIGH (7.0 to 8.9), or CRITICAL (9.0 to 10.0). Tenable uses either the CVSSv3 or the CVSSv4 score, depending on the default CVSS severity metric setting of your container. This endpoint returns the risk factor in uppercase; Get plugin details returns it in mixed case.
synopsis	string	A brief summary of the vulnerability or vulnerabilities associated with the plugin.
cvss3_temporal_score	float	The CVSSv3 temporal metrics for the vulnerability.
cvss3_temporal_vector	object	The raw CVSSv3 temporal metrics for the vulnerability. For more information, see CVSSv3 documentation.
exploited_by_nessus	boolean	Indicates whether Nessus exploited the vulnerability during the process of identification.
cvss3_base_score	float	The CVSSv3 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments).
cvss3_vector	object	The raw CVSSv3 metrics for the vulnerability. For more information, see CVSSv3 documentation.
cvss3_score_source	string	The source of the CVSSv3 score. This is the CVE that the score is derived from, or `manual` if Tenable assigned the score directly.
cvss4_base_score	float	The CVSSv4 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments). Only plugins that Tenable has scored with CVSSv4 include this attribute.
cvss4_threat_score	float	The CVSSv4 threat score for the vulnerability. CVSSv4 threat metrics replace the temporal metrics used in earlier CVSS versions.
cvss4_vector	string	The raw CVSSv4 base metrics for the vulnerability, for example CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N.
cvss4_threat_vector	string	The raw CVSSv4 threat metrics for the vulnerability, for example CVSS:4.0/E:P.
cvss4_supplemental	string	The raw CVSSv4 supplemental metrics for the vulnerability, for example CVSS:4.0/U:Amber. These metrics provide additional context and do not affect the CVSSv4 score.
cvss4_score_source	string	The source of the CVSSv4 score. This is the CVE that the score is derived from, or `manual` if Tenable assigned the score directly.
exploit_framework_metasploit	boolean	Indicates whether an exploit exists in the Metasploit framework.
plugin_type	string	Plugin type, for example, local, remote, or combined. For more information about plugin type, see Nessus Plugin Types and Categories in the Tenable Community Portal.
vpr	object	Information about the Vulnerability Priority Rating (VPR) for the plugin, including the VPR score, VPR drivers, and when Vulnerability Management last imported the VPR for this vulnerability. For more information, see Vulnerability Priority Rating.
agent	string	The Tenable agent platforms the plugin runs on. Possible values include windows, unix, macosx, and all.
always_run	boolean	Indicates whether Tenable runs the plugin during every scan.
asset_categories	array	The asset categories associated with the plugin, for example SECURITY_CONTROL.
asset_inventory	boolean	Indicates whether the plugin contributes data to asset inventory.
asset_inventory_category	string	The category of inventory data the plugin contributes, for example software_enumeration or user_enumeration.
bid	array	A list of Bugtraq IDs (BID) for vulnerabilities associated with the plugin.
canvas_package	string	The Immunity CANVAS exploit package that contains an exploit for the vulnerability. Only plugins with exploit_framework_canvas set to `true` include this attribute.
compliance	boolean	Indicates whether the plugin is a compliance audit check rather than a vulnerability check.
d2_elliot_name	string	The name of the D2 Elliot Web Exploitation exploit for the vulnerability. Only plugins with exploit_framework_d2_elliot set to `true` include this attribute.
dependencies	array	The plugin scripts that must run before this plugin, identified by script filename.
enable_cgi_scanning	boolean	Indicates whether the plugin only runs when CGI scanning is enabled in the scan settings.
excluded_keys	array	The knowledge base keys and scan settings that prevent the plugin from running when they are present.
exploitability_ease	string	Indicates how readily the vulnerability can be exploited. Possible values include AVAILABLE, NOT_AVAILABLE, and NOT_REQUIRED.
exploithub_sku	string	The ExploitHub SKU for the exploit for the vulnerability. Only plugins with exploit_framework_exploithub set to `true` include this attribute.
fname	string	The filename of the plugin script, for example webmirror3.nbin.
generated_plugin	string	The generation state of the plugin, for example current.
hardware_inventory	boolean	Indicates whether the plugin contributes hardware inventory data.
intel_type	string	The type of intelligence source for the plugin, for example SENSOR.
metasploit_name	string	The name of the Metasploit module that exploits the vulnerability. Only plugins with exploit_framework_metasploit set to `true` include this attribute.
os_identification	boolean	Indicates whether the plugin contributes to operating system identification.
potential_vulnerability	boolean	Indicates whether the plugin reports a potential vulnerability rather than a confirmed one.
required_keys	array	The knowledge base keys that must be present for the plugin to run, for example Host/local_checks_enabled.
required_ports	array	The ports and services that must be present for the plugin to run, for example Services/www or 80.
required_udp_ports	array	The UDP ports that must be present for the plugin to run.
script_copyright	string	The copyright notice for the plugin script.
stig_severity	string	The DISA STIG severity category for the vulnerability, for example I or II.
thorough_tests	boolean	Indicates whether the plugin only runs when thorough tests are enabled in the scan settings.
vendor_severity	string	The severity the vendor assigned to the vulnerability, for example Important or Moderate.
vendor_unpatched	boolean	Indicates whether the plugin detects a vulnerability for which the vendor has not released a patch.
vuln_publication_date	string	The date when the vulnerability associated with the plugin was publicly disclosed.

📘
Note
Certain plugins can contain additional attributes not documented here.

Example

"attributes": {
  "plugin_modification_date": "2018-07-19T00:00:00Z",
  "plugin_version": "1.12",
  "exploited_by_malware": false,
  "description": "A cross-site scripting (XSS) vulnerability exists in the admin CGI script for Mailman before 2.1.4. This update moves Mailman to version 2.1.4 which is not vulnerable to this issue.\n\nUpdated packages were made available in February 2004 however the original update notification email did not make it to fedora-announce-list at that time.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.",
  "unsupported_by_vendor": false,
  "cvss_temporal_score": 0.0,
  "patch_publication_date": "2004-02-26T00:00:00Z",
  "see_also": ["http://www.nessus.org/u?564bb3fe"],
  "default_account": false,
  "exploit_available": false,
  "exploit_framework_canvas": false,
  "cvss_base_score": 0.0,
  "solution": "Update the affected mailman and / or mailman-debuginfo packages.",
  "exploit_framework_exploithub": false,
  "cpe": ["cpe:/o:fedoraproject:fedora_core:1", "p-cpe:/a:fedoraproject:fedora:mailman-debuginfo", "p-cpe:/a:fedoraproject:fedora:mailman"],
  "plugin_publication_date": "2004-07-23T00:00:00Z",
  "exploit_framework_core": false,
  "in_the_news": false,
  "has_patch": true,
  "xref": ["FEDORA:2004-060"],
  "malware": false,
  "exploit_framework_d2_elliot": false,
  "xrefs": [{
      "type": "FEDORA",
      "id": "2004-060"
    }
  ],
  "risk_factor": "High",
  "synopsis": "The remote Fedora Core host is missing a security update.",
  "cvss3_temporal_score": 0.0,
  "exploited_by_nessus": false,
  "cvss3_base_score": 0.0,
  "exploit_framework_metasploit": false,
  "plugin_type": "local"
}