The detection consolidation plugin detects Log4j at location A, B, and C.
Based on this detection, a vulnerability for plugin with OID ending with 117842 get’s created.
This vulnerability will only show location A as location for the vulnerability. However, location B and C are not shown, while they may be the real cause of the vulnerability.
Looking at the plugins, the location is retrieved by get_app_version_and_location_from_list().
Looking at that specific function, it retrieves the location only once via ap = get_app_details(...), which only returns one result.
Expected behavior:
Either show all locations for the specific vulnerability, or:
Create the vulnerability (plugin ending with oid 117842) for each related location.
I’m actually not sure what is getting reported here because:
None of the Log4j VTs are using get_app_version_and_location_from_list()
The actual used get_app_version_and_location() function is capable to handle and return multiple locations (see output below)
As this seems to be either some environmental problem, some misunderstanding or similar i’m moving this out of the VTs category as the NASL / VT side works as expected.