Xray scan CVE uploaded in one Sonar branch reappears in another branch even if marked FP/Accept

SonarQube Cloud
,
1

Hi,

My case is of the CVE issues uploaded as on Sonarqube using sarifReports property of sonar scanner. The CVE found in Xray scan are uploaded as sarif report in Sonar for developers to work on. Now the problem we are facing is that there could be a CVE reported by Xray scan that is found in multiple applications. So if we try to mark the CVE as false-positive/accept it works for that application and some other applications. but not all the applications would respects that status change and would need explicit status change of that CVE in that particular application project only.
Also the same CVE having exact same description is reported multiple time of course due to its occurrence in different applications but when I click on the Issues tab globally in Sonar UI, there too it appears multiple times pointing to different projects it is detected and bulk update the issues also sometimes get it back.
Is there a way where in we can propagate the status changes from one branch to another. This question is very specific to the behaviour of the uploaded sarif CVEs from Xray to Sonar.
Please note that we are not updating any CVE status/metadata changes in Xray, all is being handled in Sonarqube only

Details of System:

  1. Sonarqube - Developer Edition v2025.1.3 (110580) - MQR Mode
  2. Sonar scanner - sonar-scanner-6.0.0.4432
  3. CI tool - Concourse

Appreciate you help.

Regards,

Monali

2

Hi,

Welcome to the community!

This is not available, even for routine issues and Security Hotspots.

As you noted, SonarQube is acting on the reports you feed it. Those reports contain a CVE per project, so SonarQube reports a CVE per project.

Perhaps this is what needs to happen?

 
Ann

4

So just to re confirm my understanding , even if in the Issues tab globally, I mark the CVE as false-positive, then it does not guarantee that it will reflect as false-positive for other projects, I will have to manually mark it in each and every project as false-positive.

Regards,

Monali

5

Hi Monali,

You can use bulk change on the Issues page to change the issue status across as many projects as you’ve selected issues for. Bulk change is limited to what’s showing on the page at the time. So if more issues are paginated to other pages, they won’t be included. Further, the global issues page scope is only the Main branch of each project. If you have issues showing up in non-main branches, you’ll need to mark them manually.

 
HTH,
Ann