exploited always true

[ilans]

From /Security/exploited:
"This field is set when a CVE is listed in an exploit catalog."

But it is mandatory in ExploitCatalogVulnAssessmentRelationship together with catalogType and locator.

So isn’t it always true?...

In that case, I don't understand why this field even exists.
Should I add a SHACL rule to enforce always true?

[goneall]

@rnjudge @tsteenbe - any thoughts on this one?

If we do decide to drop the field, I suggest we deprecate it in 3.1 and remove it in 4.0. I'm thinking, however, the description may need to be updated.