Use https://epss.empiricalsecurity.com/epss_scores-current.csv.gz as EPSS source file

[huornlmj]

The current EPSS (--with-epss) features relies on obtaining the EPSS data from the cyentia.com website rather than from say https://epss.empiricalsecurity.com/epss_scores-current.csv.gz where first.org suggests to obtain the data. Would it be possible so as an end user to supply their own link to the EPSS data file?

[fatihtokus]

Hi @huornlmj ,

Thanks for the tkt. I am glad to see you are using this feature.

This is a good suggestion. I guess you would supply a local csv file with the same format as the current one, yes?

Regards,
Fatih

[huornlmj]

Actually I was thinking of pointing it to the URL that first.org uses or allowing the end user to chose the URL, but I didn't check if their format differs from the format at the site you are using (cyentia.com). I assumed they were the same.

[fatihtokus]

No worries, we will check the format.
May I know if you are using our newest feature (--with-exploits) too?

[huornlmj]

No worries, we will check the format. May I know if you are using our newest feature (--with-exploits) too?

Yes I am interested in this also. I didn't check into the code yest but are you taking this from Trivys' output or is it coming from the KEV catalogue?

[fatihtokus]

It is coming from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

[huornlmj]

Oh! I thought it was coming from cyentia.com:

scan2html/internal/epss/downloader.go

Line 17 in 3b93621

epssURL = "https://epss.cyentia.com"

[fatihtokus]

There are two things:
EPSS data(--with-epss) from https://epss.cyentia.com
Known exploited vulnerabilities data(--with-exploits) from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

[fatihtokus]

@huornlmj this is fixed, please have a look