Fortify FPR files 'Instance Severity' field scale range in SCA and WebInspect

[Manasa3]

Hi, 

I'm processing the FPR files from Fortify SCA and Fortify WebInspect with the help of my own script. 

I did see a field called 'Instance Severity' under each Vulnerability in SCA FPR file. I would like to understand what the scale range for this field.

Is it 1-5 scale where 1 takes the low precedence and 5 as high? or 1-10 scale range ? 

Similarly in Fortify WebInspect FPR file, severity is calculated from 'Severity' Field. Does it also takes the scale range of 1-5?

Please find the attachment for more information.

[ebell]

The range is 0-5. <edited>

[Manasa3]

Hi ebell,
I have seen the Instance Severity field value as 5 for one of the vulnerability.
Please refer the attachment.

[ebell · Accepted solution]

My apologies. I stand corrected. I based my information off of Dynamic issues. It does appear this range is 0-5 for both. 

As SCA projects opened in Audit Workbench (or other Fortify products), it's always visualized within the context of an issue template. Based on your feedback and this information, I went looking at the docs on templates. In there I was also found where ranges went up to 5. For example, this code sample includes up to 5 for severity:

<IssueListing limit="1" listing="true"> 
  <Refinement>severity:(3.0,5.0] confidence:[4.0,5.0]</Refinement> 
    <Chart chartType="list">