Academic web application · Vulnerability management
PatchStash
A Symfony application for tracking software assets, vulnerabilities, ownership, remediation status, and patch cycles in one structured workflow.
Remediation workflow
Keep findings connected to action
Implementation snapshot
Framework
Symfony 7.3 · PHP 8.2
Intelligence
CIRCL CVE API ingestion
Scoring
CVSS v3.1, v3.0 and v2
Access model
4 operational roles
Problem statement
A vulnerability list is not a remediation process. PatchStash is designed to keep findings connected to the affected software, responsible users, patch cycle, supporting reports, and final status.
Domain model
Doctrine entities preserve the relationships needed to move from inventory to closure.
- Projects provide business context for assets and reports
- Assets and software modules describe what is deployed and which version is affected
- Vulnerabilities retain CVE identity, severity, evidence, and remediation state
- Patch cycles group planned corrective work instead of treating findings as isolated tickets
- Users, permissions, reports, and exports support ownership and review
CVE discovery and normalization
A console-driven scanner queries the CIRCL CVE API for each inventoried software product. It handles multiple response shapes, matches affected versions from structured CNA data and textual ranges, extracts CVSS 3.1, 3.0, or 2.0 metrics, maps scores into severity bands, and deduplicates by CVE plus asset before persistence.
Authorization model
Symfony Security provides form login, password hashing, CSRF protection, and route-level boundaries. Admin, Project Manager, Operator, and Auditor roles receive distinct dashboards; a permission service resolves finer-grained actions, while administrative controllers enforce explicit ROLE_ADMIN checks.
Implementation and trade-offs
The stack uses PHP 8.2, Symfony 7.3, Doctrine migrations, Twig, UX Turbo, Stimulus, validation, and PHPUnit. Keeping ingestion behind a repeatable command makes the scan observable and schedulable, while timeout and malformed-response handling prevent an external intelligence feed from breaking the core inventory workflow.