All Products
Search

This Product

    Cloud Firewall:DescribeVulnerabilityProtectedList

    Document Center

    Cloud Firewall:DescribeVulnerabilityProtectedList

    Last Updated:Jun 10, 2026

    Queries a list of vulnerabilities that Cloud Firewall can protect against.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-cloudfirewall:DescribeVulnerabilityProtectedList

    get

    *All Resource

    *

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    SourceIp deprecated

    string

    No

    The source IP address of the access request.

    112.239.XX.XX
    Lang

    string

    No

    The language of the response. Valid values:

    • zh (default): Chinese

    • en: English

    zh
    Lang

    string

    No

    The language of the response. Valid values:

    • zh (default): Chinese

    • en: English

    zh
    StartTime

    string

    Yes

    The start time of the query. The value is a UNIX timestamp. Unit: seconds.

    1655778046
    EndTime

    string

    Yes

    The end time of the query. The value is a UNIX timestamp. Unit: seconds.

    1646063922
    VulnStatus

    string

    No

    The protection status of the vulnerability. Valid values:

    • partProtected: partially protected

    • protected: protected

    • unProtected: unprotected

    Valid values:

    • protected :

      protected

    • unProtected :

      unProtected

    • partProtected :

      partProtected

    protected
    VulnCveName

    string

    No

    The CVE ID of the vulnerability.

    CVE-2022-2992
    AttackType

    string

    No

    The attack type of the vulnerability prevention event. Valid values:

    • 1: abnormal connection

    • 2: command execution

    • 3: brute-force attack

    • 4: scan

    • 5: other

    • 6: information leakage

    • 7: DoS attack

    • 8: overflow attack

    • 9: web attack

    • 10: back door

    • 11: virus

    • 12: mining behavior

    • 13: reverse shell

    Note

    If you do not set this parameter, all attack types are queried.

    13
    VulnType

    string

    No

    The type of the vulnerability. Valid values:

    • App: application vulnerability

    • emg: emergency vulnerability

    • cms: Web-CMS vulnerability

    emg
    VulnLevel

    string

    No

    The risk level of the vulnerability. Valid values:

    • high: high

    • medium: medium

    • low: low

    medium
    CurrentPage

    string

    No

    The page number of the paged query. Default value: 1.

    1
    PageSize

    string

    No

    The maximum number of entries to return on each page in a paged query. The maximum value is 50.

    10
    SortKey

    string

    No

    The sorting basis. The value is fixed as attackCnt, which indicates the number of attacks.

    attackCnt
    Order

    string

    No

    The sorting order. Valid values:

    • asc: ascending.

    • desc (default): descending.

    desc
    VulnResource

    string

    No

    The number of assets affected by the vulnerability.

    1
    UserType

    string

    No

    The user type. The value is fixed as buy, which indicates a paid-for user.

    buy
    BuyVersion

    integer

    No

    The edition of Cloud Firewall. For the pay-as-you-go edition, set the value to 10. You do not need to set this parameter for other editions.

    10
    MemberUid

    string

    No

    The UID of the member account of Cloud Firewall.

    258039427902****
    RuleTag

    string

    No

    The tag of the vulnerability. Valid values:

    • AI: AI component-related vulnerabilities

    AI

    Response elements

    Element

    Type

    Description

    Example

    object

    The response of the DescribeVulnerabilityProtectedList operation.

    RequestId

    string

    The ID of the request.

    D355C631-1537-59C5-A56E-F6C5037B99E5
    TotalCount

    integer

    The total number of vulnerabilities that are detected by Cloud Firewall.

    5
    ZeroResourceCount

    integer

    The number of vulnerabilities for which the number of affected assets is 0.

    1
    VulnList

    array<object>

    A collection of vulnerability information.

    array<object>

    The information about the vulnerability.

    VulnName

    string

    The name of the vulnerability.

    fastjson <= 1.2.80 Deserialization Arbitrary Code Execution Vulnerability

    AttackType

    integer

    The attack type of the vulnerability prevention event. Valid values:

    • 1: abnormal connection

    • 2: command execution

    • 3: brute-force attack

    • 4: scan

    • 5: other

    • 6: information leakage

    • 7: DoS attack

    • 8: overflow attack

    • 9: web attack

    • 10: back door

    • 11: virus

    • 12: mining behavior

    • 13: reverse shell

    13
    NeedRuleClass

    integer

    The threat level of the RuleClass that needs to be enabled. Valid values:

    • 1 (default): Loose

    • 2: Medium

    • 3: Strict

    1
    VulnType

    string

    The type of the vulnerability. Valid values:

    • emg: emergency vulnerability

    • webcms: Web-CMS vulnerability

    • app: application vulnerability

    emg
    VulnKey

    string

    The code of the vulnerability.

    dedecms-archive.helper.php-vul
    VulnLevel

    string

    The severity of the vulnerability. Valid values are:

    • high: High

    • medium: Medium

    • low: Low

    high
    NeedOpenBasicRule

    boolean

    The status of the basic protection policy that corresponds to the vulnerability. Valid values:

    • true: enabled

    • false: disabled

    Note

    If the value is true, you must set the status of the basic protection policy that corresponds to the vulnerability to Block for one-click protection.

    false
    CveId

    string

    The list of CVE IDs.

    12112131123, 1231123112
    FirstTime

    integer

    The time when the vulnerability was first detected. The value is a UNIX timestamp. Unit: seconds.

    1608687364
    BasicRuleIds

    string

    The ID of the associated rule.

    12,12
    LastTime

    integer

    The time when the vulnerability was last detected. The value is a UNIX timestamp. Unit: seconds.

    1608687364
    NeedOpenVirtualPatcheUuids

    string

    The UUID of the virtual patching rule that needs to be upgraded to Block mode.

    UUID-1231231234
    NeedOpenBasicRuleUuids

    string

    The UUID of the basic protection policy that needs to be upgraded to Block mode.

    UUID-1231231
    NeedOpenVirtualPatche

    boolean

    The status of the virtual patch that corresponds to the vulnerability. Valid values:

    • true: enabled

    • false: disabled

    Note

    If the value is true, you must set the status of the virtual patch that corresponds to the vulnerability to Block for one-click protection.

    true
    VirtualPatcheIds

    string

    The ID of the associated rule.

    13,13
    HighlightTag

    integer

    Indicates whether the vulnerability requires special attention. Valid values:

    • 0: no

    • 1: yes

    0
    NeedOpenRunMode

    boolean

    Indicates whether you need to set the running mode of the threat detection engine for one-click protection. Valid values:

    • true: yes

    • false: no

    true
    VulnStatus

    string

    The protection status of the vulnerability. Valid values:

    • partProtected: partially protected

    • protected: protected

    • unProtected: unprotected

    protected
    AttackCnt

    integer

    The number of attacks on the vulnerability.

    0
    ResourceCnt

    integer

    The number of assets that have the vulnerability.

    0
    MemberUid

    string

    The UID of the member account of the current Alibaba Cloud account.

    119384235299****
    ResourceList

    array<object>

    The list of assets that have the vulnerability.

    object

    The asset that has the vulnerability.

    ResourceType

    string

    The type of the asset that has the vulnerability. Valid values:

    • SLB

    • EIP

    • ECS

    EIP
    Eip

    string

    The elastic IP address (EIP) of the instance.

    203.107.XX.XX
    InternetIp

    string

    The public IP address of the instance.

    47.96.XX.XX
    VulnStatus

    string

    The protection status of the vulnerability. Valid values:

    • partProtected: partially protected

    • protected: protected

    • unProtected: unprotected

    protected
    ResourceId

    string

    The ID of the instance.

    vfw-m5e7dbc4y****
    ResourceName

    string

    The name of the instance.

    ECS
    IntranetIp

    string

    The private IP address of the instance.

    192.168.XX.XX
    RegionId

    string

    The region ID of the Cloud Firewall instance.

    Note

    For more information about the regions where Cloud Firewall is available, see Supported regions.

    cn-beijing
    RuleTag

    string

    The tag of the vulnerability.

    Valid values:

    • AI :

      AI-related vulnerabilities

    AI

    Examples

    Success response

    JSON format

    {
  "RequestId": "D355C631-1537-59C5-A56E-F6C5037B99E5",
  "TotalCount": 5,
  "ZeroResourceCount": 1,
  "VulnList": [
    {
      "VulnName": "fastjson <= 1.2.80 Deserialization Arbitrary Code Execution Vulnerability\n",
      "AttackType": 13,
      "NeedRuleClass": 1,
      "VulnType": "emg",
      "VulnKey": "dedecms-archive.helper.php-vul",
      "VulnLevel": "high",
      "NeedOpenBasicRule": false,
      "CveId": "12112131123, 1231123112",
      "FirstTime": 1608687364,
      "BasicRuleIds": "12,12",
      "LastTime": 1608687364,
      "NeedOpenVirtualPatcheUuids": "UUID-1231231234",
      "NeedOpenBasicRuleUuids": "UUID-1231231",
      "NeedOpenVirtualPatche": true,
      "VirtualPatcheIds": "13,13",
      "HighlightTag": 0,
      "NeedOpenRunMode": true,
      "VulnStatus": "protected",
      "AttackCnt": 0,
      "ResourceCnt": 0,
      "MemberUid": "119384235299****",
      "ResourceList": [
        {
          "ResourceType": "EIP",
          "Eip": "203.107.XX.XX",
          "InternetIp": "47.96.XX.XX",
          "VulnStatus": "protected",
          "ResourceId": "vfw-m5e7dbc4y****",
          "ResourceName": "ECS",
          "IntranetIp": "192.168.XX.XX",
          "RegionId": "cn-beijing"
        }
      ],
      "RuleTag": "AI"
    }
  ]
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 ErrorAliUid Aliuid invalid. The aliuid is invalid.
    400 ErrorAttackTypeError attack type invalid. The specified type is invalid. Select again.
    400 ErrorPageNo Either page number or page size is invalid. Either page number or page size is invalid.
    400 ErrorParameters A parameter error occurred. A parameter error occurred.
    400 ErrorDBSelectError A database select error occurred. The error message returned because an internal error has occurred in querying the database.
    400 ErrorMarshalJSON internal error. Internal error.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.