I use the Community Edition of SonarQube and I get listings of CWE violations as well as OWASP listings. So why do I need the Enterprise Edition? I know the documentation say Security Report but what does that mean exactly? I don’t care for fancy reports. I only need to detect vulnerability risks.

Hi Carine I’m using 8.6 Thanks Robert

[image] leer5: I get listings of CWE violations as well as OWASP listings Can you send here some screenshot of what you see? and in which languages? To summarise “quickly” what you will get in addition in the Enterprise Edition : Detection of injection flaws rules in Java, C#, PHP, Python,…

[image] I’m using Java. SQ 8.6 CE.

Looks like I’m getting the CWE and OWASP in the Community Edition.

You will have some rules available in the Community Edition (basic ones). You can see on our rules website, which rules are available starting in Community, which are available only in Developer+ editions, at the bottom of each rule description. To benefit from detection of injection (like SQL inje…

Thank you for this clarification. Can you answer one more question? My Dev Env is cut off from the internet so how do I get updates to these rules or when there are new ways to compromise or violate the rules? Thanks.

Hi @leer5 , this is a completely different question and a good practice here is to open a new thread for a new topic :slight_smile: I will answer here as this one is quite “easy”: new rules that are added in the releases of SonarQube versions will be added to your SonarQube after you do the upgrade…

OWASP/CWE in Community Edition

SonarQube Server / Community Build

Carine_Bayon (Carine Bayon) February 15, 2021, 9:23am 2

Hi @leer5 ,
Which version of SonarQube Community Edition are you using?
Thanks,
Carine

Topic		Replies	Views
Security Reports SonarQube Server / Community Build sonarqube	1	2498	November 5, 2020
OWASP coverage in SonarQube editions SonarQube Server / Community Build security	1	1256	July 20, 2020
Rules available in which Sonarqube edition SonarQube Server / Community Build java , sonarqube , rules	1	849	December 12, 2019
SonarQube security rules - Community, Developer, other editions SonarQube Server / Community Build security	5	4132	July 20, 2020
Difference in security hotspot detection between EnterpriseEdition and CommunityEdition SonarQube Server / Community Build sonarqube , security-hotspot	3	383	June 24, 2022

OWASP/CWE in Community Edition

Related topics