← retour aux outils back to tools

# OWASP Dependency-Check

Identifie les bibliothèques tierces vulnérables connues dans les dépendances d'un projet en les comparant à la base de données CVE du NVD. Identifies known vulnerable third-party libraries in project dependencies by matching against the NVD CVE database.

↗ https://owasp.org/www-project-dependency-check

## Overview

OWASP Dependency-Check performs Software Composition Analysis (SCA) — it identifies project dependencies and checks whether any contain known public vulnerabilities (CVEs) using the NVD database.

## Common Usage

Scan a directory

    dependency-check.sh --project "MyApp" --scan /path/to/project --out reports/

Scan specific file types

    dependency-check.sh --project "MyApp" --scan . --out reports/ \
      --enableExperimental

Java/Maven project

    dependency-check.sh --project "MyApp" --scan target/ --out reports/

Node.js project

    dependency-check.sh --project "MyApp" --scan . --out reports/ \
      --nodePackageSkipDevDependencies

Update NVD database only

    dependency-check.sh --updateonly

Output formats

    dependency-check.sh --project "MyApp" --scan . \
      --format HTML --format JSON --out reports/

## Maven Plugin

    <!-- pom.xml -->
    <plugin>
      <groupId>org.owasp</groupId>
      <artifactId>dependency-check-maven</artifactId>
      <version>latest</version>
    </plugin>

    mvn dependency-check:check

## Interpreting Results

- CVSS Score 9.0+ — Critical, investigate immediately
- Focus on direct dependencies first (you can fix these)
- Check if the vulnerable code path is actually reachable
- Look for available patched versions

Help / Man page

    dependency-check.sh [options]

    REQUIRED:
      --project NAME      Project name
      --scan PATH         Path to scan (repeatable)
      --out DIR           Output directory

    SCAN OPTIONS:
      --enableExperimental  Enable experimental analyzers
      --enableRetired       Enable retired analyzers
      --nodePackageSkipDevDependencies  Skip devDependencies
      --exclude PATTERN   Exclude files matching pattern

    OUTPUT:
      --format FORMAT     HTML (default), JSON, XML, CSV, SARIF, JUNIT
      --prettyPrint       Pretty-print JSON/XML output

    DATABASE:
      --updateonly        Update NVD database only, don't scan
      --nvdApiKey KEY     NVD API key for faster updates
      --noupdate          Skip NVD update (use cached data)
      --connectionTimeout N  Timeout for NVD downloads

    REPORTING:
      --failOnCVSS N      Exit with error if CVSS >= N
      --junitFailOnCVSS N JUnit failure threshold
      --suppression FILE  XML file of false-positive suppressions

## Vue d’ensemble

OWASP Dependency-Check réalise une analyse de composition logicielle (SCA) : il identifie les dépendances du projet et vérifie si l’une d’elles contient des vulnérabilités publiques connues (CVEs) en utilisant la base de données NVD.

## Utilisation courante

    # Scanner un répertoire
    dependency-check.sh --project "MyApp" --scan /path/to/project --out reports/

    # Scanner des types de fichiers spécifiques
    dependency-check.sh --project "MyApp" --scan . --out reports/ \
      --enableExperimental

    # Projet Java/Maven
    dependency-check.sh --project "MyApp" --scan target/ --out reports/

    # Projet Node.js
    dependency-check.sh --project "MyApp" --scan . --out reports/ \
      --nodePackageSkipDevDependencies

    # Mettre à jour la base NVD uniquement
    dependency-check.sh --updateonly

    # Formats de sortie
    dependency-check.sh --project "MyApp" --scan . \
      --format HTML --format JSON --out reports/

## Plugin Maven

    <!-- pom.xml -->
    <plugin>
      <groupId>org.owasp</groupId>
      <artifactId>dependency-check-maven</artifactId>
      <version>latest</version>
    </plugin>

    mvn dependency-check:check

## Interprétation des résultats

- Score CVSS 9.0+ : Critique, à investiguer immédiatement
- Se concentrer d’abord sur les dépendances directes (vous pouvez les corriger)
- Vérifier si le chemin de code vulnérable est réellement accessible
- Chercher les versions corrigées disponibles

Aide / Page de manuel

    dependency-check.sh [options]

    REQUIRED:
      --project NAME      Project name
      --scan PATH         Path to scan (repeatable)
      --out DIR           Output directory

    SCAN OPTIONS:
      --enableExperimental  Enable experimental analyzers
      --enableRetired       Enable retired analyzers
      --nodePackageSkipDevDependencies  Skip devDependencies
      --exclude PATTERN   Exclude files matching pattern

    OUTPUT:
      --format FORMAT     HTML (default), JSON, XML, CSV, SARIF, JUNIT
      --prettyPrint       Pretty-print JSON/XML output

    DATABASE:
      --updateonly        Update NVD database only, don't scan
      --nvdApiKey KEY     NVD API key for faster updates
      --noupdate          Skip NVD update (use cached data)
      --connectionTimeout N  Timeout for NVD downloads

    REPORTING:
      --failOnCVSS N      Exit with error if CVSS >= N
      --junitFailOnCVSS N JUnit failure threshold
      --suppression FILE  XML file of false-positive suppressions