[FP]: tool is detecting a vulnerability on the basis of a product jar name which happens to be same name as of a 3PP

[va699]

Package URl

pkg:maven/com.XXX.YYY.ZZZ.server/webgui@1.0.15-57

CPE

cpe:2.3:a:webgui:webgui:1.0.15.57:::::::*

CVE

CVE-2008-4798

ODC Integration

{"label" => "Docker"}

ODC Version

12

Description

in our product, we have a inbuilt jar with the name as webgui and dependency checker is wrongly identifying it as a 3PP with the same name. and hence find it to be vulnerable.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/18375071622

[chadlwilson]

You need to maintain your own suppression file rule for this. We can't maintain false positive suppression rules for all possible proprietary products out there.