Troubleshoot CVSS3 Base Score Differences in QQL and Exported Reports

Problem

When you filter vulnerabilities by a specific CVSS v3 base score using QQL on the Vulnerabilities tab, the downloaded report may include vulnerabilities with different CVSS v3 base scores. For example, when you run a QQL query for a specific CVSS v3 base score, the Vulnerabilities tab displays a lower count (for example, 100 results). For example, a query: vulnerabilities.vulnerability.cvss3_1Info.baseScore:7.

However, when you download the report using the CVE download type, the report may contain more entries (for example, 150 results).
On reviewing the downloaded report, additional CVSS v3 base scores (such as 5.5) are included, even though they are not part of the selected QQL filter.

Cause

This may happen because a single QID can be associated with multiple CVEs, each with a different CVSS base score. For example, when you run the QQL:  vulnerabilities.vulnerability.cvss3_1Info.baseScore:7

The results display QIDs with the highest contributing CVSS v3 base score of 7. However, those same QIDs may also include CVEs with lower CVSS base scores. When you download the report using the CVE download type, the report includes all CVEs linked to the QIDs, including those with lower CVSS v3 base scores.

Solution

Download the report by using the QID download option to ensure that the results align with the QQL filter applied in the UI.