vulnerability

ArchiMate / Open Group Equivalent: Vulnerability / Weakness Element (Security Architecture Aspect)

Represents a known software security flaw, CVE bulletin, or architectural weakness present in components, applications, or infrastructure.

Visual Styling

To apply custom icons or styling to vulnerabilities, use a Style Rule (e.g. style vulnerability where cvss_score >= 8.0 { icon "bug" custom_css "fill: #991b1b;" }).

---

Syntax

vulnerability <id> "<Display Name>" {
    description "<text>"
    owner "<team>"
    tags ["tag1", "tag2"]
    cvss_score <number>
    cve_id "<cve_identifier>"

    relationships { ... }
}

---

Properties

Property	Type	Allowed Values	Description
description	string	Free text	Explanation of the vulnerability and attack vector
owner	string	Free text	Remediation team or patch owner
tags	string[]	Array of strings	Categorization tags
cvss_score	number	0.0 to 10.0	CVSS v3.1 base score rating
cve_id	string	e.g. "CVE-2024-3094"	Common Vulnerabilities and Exposures identifier

---

Allowed Relationship Verbs & Targets

Verb	ArchiMate / Security Relation	Allowed Target Entity Types
targets	Exploitation	system, app, component, infrastructure, data_object, process, actor, agent, trust_boundary
governed_by	Governance	policy, standard

---

Complete Example

vulnerability vuln_openssh_rce "OpenSSH RegreSSHion RCE" {
    description "Signal handler race condition in OpenSSH server allowing remote code execution"
    cve_id "CVE-2024-6387"
    cvss_score 8.1
    tags ["rce", "cve", "high-severity"]

    relationships {
        this targets infra_bastion_host "Discovered on jump host bastion"
        this governed_by pol_patch_management "Requires patch deployment within 7 days"
    }
}