Unable to filter by CVE details on software/versions page

[jmwatts]

Fleet version: v4.61.0

Web browser and operating system: Chrome 131.0.6778.110 on macOS

---

💥  Actual behavior

Spinner, error message is shown. Error in log (see More info)

🧑‍💻  Steps to reproduce

On Fleet PREMIUM instance:

1. Go to Software >> enable the "Show versions" toggle
2. In "Add filters" toggle on "Vulnerable software", choose a severity, check "Has known exploit"
3. Click Apply

🕯️ Expected

Page loads with filters applied

🕯️ More info (optional)

level=error ts=2024-12-13T20:09:06.748592Z component=http [email protected] method=GET uri="/api/latest/fleet/software/versions?page=0&per_page=20&order_direction=desc&order_key=hosts_count&team_id=12&vulnerable=true&exploit=true&min_cvss_score=0.1&max_cvss_score=3.9&without_vulnerability_details=true" took=957.625µs err="Requires Fleet Premium license" uuid=12435b5f-0034-4caa-96fc-1f9d7d8c4379
level=error ts=2024-12-13T20:09:07.849542Z component=http [email protected] method=GET uri="/api/latest/fleet/software/versions?page=0&per_page=20&order_direction=desc&order_key=hosts_count&team_id=12&vulnerable=true&exploit=true&min_cvss_score=0.1&max_cvss_score=3.9&without_vulnerability_details=true" took=489.208µs err="Requires Fleet Premium license" uuid=12435b5f-0034-4caa-96fc-1f9d7d8c4379
level=debug ts=2024-12-13T20:09:07.910052Z component=http method=POST uri=/api/v1/osquery/config took=9.344333ms ip_addr=47.32.18.149 x_for_ip_addr=47.32.18.149
level=debug ts=2024-12-13T20:09:08.35997Z component=http method=POST uri=/api/v1/osquery/distributed/read took=1.451292ms ip_addr=47.32.18.149 x_for_ip_addr=47.32.18.149
level=error ts=2024-12-13T20:09:10.009409Z component=http [email protected] method=GET uri="/api/latest/fleet/software/versions?page=0&per_page=20&order_direction=desc&order_key=hosts_count&team_id=12&vulnerable=true&exploit=true&min_cvss_score=0.1&max_cvss_score=3.9&without_vulnerability_details=true" took=359µs err="Requires Fleet Premium license" uuid=12435b5f-0034-4caa-96fc-1f9d7d8c4379
level=error ts=2024-12-13T20:09:14.183019Z component=http [email protected] method=GET uri="/api/latest/fleet/software/versions?page=0&per_page=20&order_direction=desc&order_key=hosts_count&team_id=12&vulnerable=true&exploit=true&min_cvss_score=0.1&max_cvss_score=3.9&without_vulnerability_details=true" took=597.375µs err="Requires Fleet Premium license" uuid=12435b5f-0034-4caa-96fc-1f9d7d8c4379
level=debug ts=2024-12-13T20:09:14.300248Z component=http [email protected] method=GET uri="/api/latest/fleet/software/titles?page=0&per_page=20&order_direction=desc&order_key=hosts_count&team_id=12&available_for_install=true&vulnerable=true&exploit=true&min_cvss_score=0.1&max_cvss_score=3.9" took=26.41575ms

[iansltx]

Test scenarios (pasted from Slack; h/t @ksykulev)

fleet free
-> no vulnerability filter

• &without_vulnerability_details=false - should ignore and still show without details
• &without_vulnerability_details=true - should show without details
  -> vulnerability filter
• &without_vulnerability_details=false - should ignore and still show without details
• &without_vulnerability_details=true - should show without details

fleet premium
-> no vulnerability filter

• &without_vulnerability_details=false - doesn't show details

• &without_vulnerability_details=true - doesn't show details, is performant
  -> vulnerability filter

• &without_vulnerability_details=false - shows details, is heavy for large page sizes

• &without_vulnerability_details=true - doesn't show details, is slightly less heavy for large page sizes

• Also should test Free with vulnerability filters to confirm that we get license errors there.

[jmwatts]

QA Notes:

Per test plan in comment above, as well as UI validation that all features/filters are functional as appropriate for Fleet free vs Fleet Premium, this issue has been resolved.