cvss-suite 1.1.0 → 1.2.2

data/lib/cvss_suite/cvss2/cvss2_environmental.rb

@@ -14,61 +14,60 @@ require_relative '../cvss_metric'
 ##
 # This class represents a CVSS Environmental metric in version 2.
 
-class Cvss2Environmental < CvssMetric
+module CvssSuite
+  class Cvss2Environmental < CvssMetric
+    ##
+    # Property of this metric
 
-  ##
-  # Property of this metric
+    attr_reader :collateral_damage_potential, :target_distribution, :security_requirements_cr,
+                :security_requirements_ir, :security_requirements_ar
 
-  attr_reader :collateral_damage_potential, :target_distribution, :security_requirements_cr,
-              :security_requirements_ir, :security_requirements_ar
+    ##
+    # Returns score of this metric
 
-  ##
-  # Returns score of this metric
+    def score(base, temporal_score)
+      base_score = (base.score @security_requirements_cr.score, @security_requirements_ir.score, @security_requirements_ar.score).round(1)
 
-  def score(base, temporal_score)
-    base_score = (base.score @security_requirements_cr.score, @security_requirements_ir.score, @security_requirements_ar.score).round(1)
+      adjusted_temporal = (base_score * temporal_score).round(1)
+      (adjusted_temporal + (10 - adjusted_temporal) * @collateral_damage_potential.score) * @target_distribution.score
+    end
 
-    adjusted_temporal = (base_score * temporal_score).round(1)
-    (adjusted_temporal + (10 - adjusted_temporal) * @collateral_damage_potential.score) * @target_distribution.score
+    private
 
-  end
-
-  private
-
-  def init_properties
-    @properties.push(@collateral_damage_potential =
-                      CvssProperty.new(name: 'Collateral Damage Potential', abbreviation: 'CDP', position: [6, 9],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Low', abbreviation: 'L', weight: 0.1 },
-                                                 { name: 'Low-Medium', abbreviation: 'LM', weight: 0.3 },
-                                                 { name: 'Medium-High', abbreviation: 'MH', weight: 0.4 },
-                                                 { name: 'High', abbreviation: 'H', weight: 0.5 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 0.0 }]))
-    @properties.push(@target_distribution =
-                      CvssProperty.new(name: 'Target Distribution', abbreviation: 'TD', position: [7, 10],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Low', abbreviation: 'L', weight: 0.25 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 0.75 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1.0 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
-    @properties.push(@security_requirements_cr =
-                      CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
-                                       choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 1.0 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1.51 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
-    @properties.push(@security_requirements_ir =
-                      CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
-                                       choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 1.0 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1.51 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
-    @properties.push(@security_requirements_ar =
-                      CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
-                                       choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 1.0 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1.51 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+    def init_properties
+      @properties.push(@collateral_damage_potential =
+                         CvssProperty.new(name: 'Collateral Damage Potential', abbreviation: 'CDP', position: [6, 9],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.1 },
+                                                    { name: 'Low-Medium', abbreviation: 'LM', weight: 0.3 },
+                                                    { name: 'Medium-High', abbreviation: 'MH', weight: 0.4 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.5 },
+                                                    { name: 'Not Defined', abbreviation: 'ND', weight: 0.0 }]))
+      @properties.push(@target_distribution =
+                         CvssProperty.new(name: 'Target Distribution', abbreviation: 'TD', position: [7, 10],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.25 },
+                                                    { name: 'Medium', abbreviation: 'M', weight: 0.75 },
+                                                    { name: 'High', abbreviation: 'H', weight: 1.0 },
+                                                    { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+      @properties.push(@security_requirements_cr =
+                         CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
+                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                    { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                    { name: 'High', abbreviation: 'H', weight: 1.51 },
+                                                    { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+      @properties.push(@security_requirements_ir =
+                         CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
+                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                    { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                    { name: 'High', abbreviation: 'H', weight: 1.51 },
+                                                    { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+      @properties.push(@security_requirements_ar =
+                         CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
+                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                    { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                    { name: 'High', abbreviation: 'H', weight: 1.51 },
+                                                    { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+    end
   end
 end
-

data/lib/cvss_suite/cvss2/cvss2_temporal.rb

@@ -14,44 +14,46 @@ require_relative '../cvss_metric'
 ##
 # This class represents a CVSS Temporal metric in version 2.
 
-class Cvss2Temporal < CvssMetric
-
-  ##
-  # Property of this metric
-
-  attr_reader :exploitability, :remediation_level, :report_confidence
-
-  ##
-  # Returns score of this metric
-
-  def score
-    return 1 unless valid?
-    @exploitability.score * @remediation_level.score * @report_confidence.score
-  end
-
-  private
-
-  def init_properties
-    @properties.push(@exploitability =
-                      CvssProperty.new(name: 'Exploitability', abbreviation: 'E', position: [6],
-                                       choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
-                                                 { name: 'Unproven', abbreviation: 'U', weight: 0.85 },
-                                                 { name: 'Proof-of-Concept', abbreviation: 'POC', weight: 0.9 },
-                                                 { name: 'Functional', abbreviation: 'F', weight: 0.95 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1 }]))
-    @properties.push(@remediation_level =
-                      CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [7],
-                                       choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
-                                                 { name: 'Official Fix', abbreviation: 'OF', weight: 0.87 },
-                                                 { name: 'Temporary Fix', abbreviation: 'TF', weight: 0.9 },
-                                                 { name: 'Workaround', abbreviation: 'W', weight: 0.95 },
-                                                 { name: 'Unavailable', abbreviation: 'U', weight: 1 }]))
-
-    @properties.push(@report_confidence =
-                      CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [8],
-                                       choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
-                                                 { name: 'Unconfirmed', abbreviation: 'UC', weight: 0.9 },
-                                                 { name: 'Uncorroborated', abbreviation: 'UR', weight: 0.95 },
-                                                 { name: 'Confirmed', abbreviation: 'C', weight: 1 }]))
+module CvssSuite
+  class Cvss2Temporal < CvssMetric
+    ##
+    # Property of this metric
+
+    attr_reader :exploitability, :remediation_level, :report_confidence
+
+    ##
+    # Returns score of this metric
+
+    def score
+      return 1 unless valid?
+
+      @exploitability.score * @remediation_level.score * @report_confidence.score
+    end
+
+    private
+
+    def init_properties
+      @properties.push(@exploitability =
+                         CvssProperty.new(name: 'Exploitability', abbreviation: 'E', position: [6],
+                                          choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
+                                                    { name: 'Unproven', abbreviation: 'U', weight: 0.85 },
+                                                    { name: 'Proof-of-Concept', abbreviation: 'POC', weight: 0.9 },
+                                                    { name: 'Functional', abbreviation: 'F', weight: 0.95 },
+                                                    { name: 'High', abbreviation: 'H', weight: 1 }]))
+      @properties.push(@remediation_level =
+                         CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [7],
+                                          choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
+                                                    { name: 'Official Fix', abbreviation: 'OF', weight: 0.87 },
+                                                    { name: 'Temporary Fix', abbreviation: 'TF', weight: 0.9 },
+                                                    { name: 'Workaround', abbreviation: 'W', weight: 0.95 },
+                                                    { name: 'Unavailable', abbreviation: 'U', weight: 1 }]))
+
+      @properties.push(@report_confidence =
+                         CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [8],
+                                          choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
+                                                    { name: 'Unconfirmed', abbreviation: 'UC', weight: 0.9 },
+                                                    { name: 'Uncorroborated', abbreviation: 'UR', weight: 0.95 },
+                                                    { name: 'Confirmed', abbreviation: 'C', weight: 1 }]))
+    end
   end
 end

data/lib/cvss_suite/cvss3/cvss3.rb

@@ -8,7 +8,7 @@
 # This work is licensed under the terms of the MIT license.
 # See the LICENSE.md file in the top-level directory.
 
-require_relative '../../../lib/cvss_suite/cvss'
+require_relative '../cvss'
 require_relative 'cvss3_base'
 require_relative 'cvss3_temporal'
 require_relative 'cvss3_environmental'
@@ -16,37 +16,45 @@ require_relative 'cvss3_environmental'
 ##
 # This class represents a CVSS vector in version 3.0.
 
-class Cvss3 < Cvss
+module CvssSuite
+  class Cvss3 < Cvss
+    ##
+    # Returns the Version of the CVSS vector.
 
-  ##
-  # Returns the Base Score of the CVSS vector.
+    def version
+      3.0
+    end
 
-  def base_score
-    check_validity
-    @base.score.round_up(1)
-  end
+    ##
+    # Returns the Base Score of the CVSS vector.
 
-  ##
-  # Returns the Temporal Score of the CVSS vector.
+    def base_score
+      check_validity
+      Cvss3Helper.round_up(@base.score)
+    end
 
-  def temporal_score
-    (@base.score.round_up(1) * @temporal.score).round_up(1)
-  end
+    ##
+    # Returns the Temporal Score of the CVSS vector.
 
-  ##
-  # Returns the Environmental Score of the CVSS vector.
+    def temporal_score
+      Cvss3Helper.round_up(Cvss3Helper.round_up(@base.score) * @temporal.score)
+    end
 
-  def environmental_score
-    return temporal_score unless @environmental.valid?
-    (@environmental.score @temporal.score).round_up(1)
-  end
+    ##
+    # Returns the Environmental Score of the CVSS vector.
 
-  private
+    def environmental_score
+      return temporal_score unless @environmental.valid?
 
-  def init_metrics
-    @base = Cvss3Base.new(@properties)
-    @temporal = Cvss3Temporal.new(@properties)
-    @environmental = Cvss3Environmental.new(@properties)
-  end
+      Cvss3Helper.round_up(@environmental.score(@base, @temporal))
+    end
+
+    private
 
-end
+    def init_metrics
+      @base = Cvss3Base.new(@properties)
+      @temporal = Cvss3Temporal.new(@properties)
+      @environmental = Cvss3Environmental.new(@properties)
+    end
+  end
+end

data/lib/cvss_suite/cvss3/cvss3_base.rb

@@ -15,81 +15,80 @@ require_relative '../helpers/cvss3_helper'
 ##
 # This class represents a CVSS Base metric in version 3.
 
-class Cvss3Base < CvssMetric
+module CvssSuite
+  class Cvss3Base < CvssMetric
+    ##
+    # Property of this metric
 
-  ##
-  # Property of this metric
+    attr_reader :attack_vector, :attack_complexity, :privileges_required, :user_interaction,
+                :scope, :confidentiality, :integrity, :availability
 
-  attr_reader :attack_vector, :attack_complexity, :privileges_required, :user_interaction,
-              :scope, :confidentiality, :integrity, :availability
+    ##
+    # Returns score of this metric
 
-  ##
-  # Returns score of this metric
+    def score
+      privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
 
-  def score
+      exploitability = 8.22 * @attack_vector.score * @attack_complexity.score * privilege_score * @user_interaction.score
 
-    privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
+      isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
 
-    exploitability = 8.22 * @attack_vector.score * @attack_complexity.score * privilege_score * @user_interaction.score
+      impact_sub_score = if @scope.selected_choice[:name] == 'Changed'
+                           7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
+                         else
+                           6.42 * isc_base
+                         end
 
-    isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
+      return 0 if impact_sub_score <= 0
 
-    if @scope.selected_choice[:name] == 'Changed'
-      impact_sub_score = 7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
-    else
-      impact_sub_score = 6.42 * isc_base
+      if @scope.selected_choice[:name] == 'Changed'
+        [10, 1.08 * (impact_sub_score + exploitability)].min
+      else
+        [10, impact_sub_score + exploitability].min
+      end
     end
 
-    return 0 if impact_sub_score <= 0
-
-    if @scope.selected_choice[:name] == 'Changed'
-      [10, 1.08 * (impact_sub_score + exploitability)].min
-    else
-      [10, impact_sub_score + exploitability].min
+    private
+
+    def init_properties
+      @properties.push(@attack_vector =
+                         CvssProperty.new(name: 'Attack Vector', abbreviation: 'AV', position: [0],
+                                          choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
+                                                    { name: 'Adjacent', abbreviation: 'A', weight: 0.62 },
+                                                    { name: 'Local', abbreviation: 'L', weight: 0.55 },
+                                                    { name: 'Physical', abbreviation: 'P', weight: 0.2 }]))
+      @properties.push(@attack_complexity =
+                         CvssProperty.new(name: 'Attack Complexity', abbreviation: 'AC', position: [1],
+                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.44 }]))
+      @properties.push(@privileges_required =
+                         CvssProperty.new(name: 'Privileges Required', abbreviation: 'PR', position: [2],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.62 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.27 }]))
+      @properties.push(@user_interaction =
+                         CvssProperty.new(name: 'User Interaction', abbreviation: 'UI', position: [3],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
+                                                    { name: 'Required', abbreviation: 'R', weight: 0.62 }]))
+      @properties.push(@scope =
+                         CvssProperty.new(name: 'Scope', abbreviation: 'S', position: [4],
+                                          choices: [{ name: 'Unchanged', abbreviation: 'U' },
+                                                    { name: 'Changed', abbreviation: 'C' }]))
+      @properties.push(@confidentiality =
+                         CvssProperty.new(name: 'Confidentiality', abbreviation: 'C', position: [5],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.22 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.56 }]))
+      @properties.push(@integrity =
+                         CvssProperty.new(name: 'Integrity', abbreviation: 'I', position: [6],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.22 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.56 }]))
+      @properties.push(@availability =
+                         CvssProperty.new(name: 'Availability', abbreviation: 'A', position: [7],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.22 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.56 }]))
     end
   end
-
-  private
-
-  def init_properties
-    @properties.push(@attack_vector =
-                      CvssProperty.new(name: 'Attack Vector', abbreviation: 'AV', position: [0],
-                                       choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
-                                                 { name: 'Adjacent', abbreviation: 'A', weight: 0.62 },
-                                                 { name: 'Local', abbreviation: 'L', weight: 0.55 },
-                                                 { name: 'Physical', abbreviation: 'P', weight: 0.2 }]))
-    @properties.push(@attack_complexity =
-                      CvssProperty.new(name: 'Attack Complexity', abbreviation: 'AC', position: [1],
-                                       choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
-                                                 { name: 'High', abbreviation: 'H', weight: 0.44 }]))
-    @properties.push(@privileges_required =
-                      CvssProperty.new(name: 'Privileges Required', abbreviation: 'PR', position: [2],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
-                                                 { name: 'Low', abbreviation: 'L', weight: 0.62 },
-                                                 { name: 'High', abbreviation: 'H', weight: 0.27 }]))
-    @properties.push(@user_interaction =
-                      CvssProperty.new(name: 'User Interaction', abbreviation: 'UI', position: [3],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
-                                                 { name: 'Required', abbreviation: 'R', weight: 0.62 }]))
-    @properties.push(@scope =
-                      CvssProperty.new(name: 'Scope', abbreviation: 'S', position: [4],
-                                       choices: [{ name: 'Unchanged', abbreviation: 'U' },
-                                                 { name: 'Changed', abbreviation: 'C' }]))
-    @properties.push(@confidentiality =
-                      CvssProperty.new(name: 'Confidentiality', abbreviation: 'C', position: [5],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Low', abbreviation: 'L', weight: 0.22 },
-                                                 { name: 'High', abbreviation: 'H', weight: 0.56 }]))
-    @properties.push(@integrity =
-                      CvssProperty.new(name: 'Integrity', abbreviation: 'I', position: [6],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Low', abbreviation: 'L', weight: 0.22 },
-                                                 { name: 'High', abbreviation: 'H', weight: 0.56 }]))
-    @properties.push(@availability =
-                      CvssProperty.new(name: 'Availability', abbreviation: 'A', position: [7],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Low', abbreviation: 'L', weight: 0.22 },
-                                                 { name: 'High', abbreviation: 'H', weight: 0.56 }]))
-  end
 end
-

data/lib/cvss_suite/cvss3/cvss3_environmental.rb

@@ -15,130 +15,182 @@ require_relative '../helpers/cvss3_helper'
 ##
 # This class represents a CVSS Environmental metric in version 3.
 
-class Cvss3Environmental < CvssMetric
+module CvssSuite
+  class Cvss3Environmental < CvssMetric
+    ##
+    # Property of this metric
 
-  ##
-  # Property of this metric
+    attr_reader :confidentiality_requirement, :integrity_requirement, :availability_requirement,
+                :modified_attack_vector, :modified_attack_complexity, :modified_privileges_required,
+                :modified_user_interaction, :modified_scope, :modified_confidentiality,
+                :modified_integrity, :modified_availability
 
-  attr_reader :confidentiality_requirement, :integrity_requirement, :availability_requirement,
-              :modified_attack_vector, :modified_attack_complexity, :modified_privileges_required,
-              :modified_user_interaction, :modified_scope, :modified_confidentiality,
-              :modified_integrity, :modified_availability
+    ##
+    # Returns score of this metric
 
-  ##
-  # Returns score of this metric
+    def score(base, temporal)
+      @base = base
 
-  def score(temporal_score)
+      merged_modified_privileges_required = @modified_privileges_required
+      if @modified_privileges_required.selected_choice[:name] == 'Not Defined'
+        merged_modified_privileges_required = @base.privileges_required
+      end
 
-    privilege_score = Cvss3Helper.privileges_required_score @modified_privileges_required, @modified_scope
+      merged_modified_scope = @modified_scope
+      if @modified_scope.selected_choice[:name] == 'Not Defined'
+        merged_modified_scope = @base.scope
+      end
 
-    modified_exploitability_sub_score = modified_exploitability_sub privilege_score
+      privilege_score = Cvss3Helper.privileges_required_score(merged_modified_privileges_required, merged_modified_scope)
 
-    isc_modified_score = isc_modified
+      modified_exploitability_sub_score = modified_exploitability_sub(privilege_score)
 
-    modified_impact_sub_score = modified_impact_sub isc_modified_score
+      modified_impact_sub_score = modified_impact_sub(isc_modified)
 
-    return 0 if modified_impact_sub_score <= 0
+      return 0 if modified_impact_sub_score <= 0
 
-    calculate_score modified_impact_sub_score, modified_exploitability_sub_score, temporal_score
-  end
+      calculate_score modified_impact_sub_score, modified_exploitability_sub_score, temporal.score
+    end
 
-  private
-
-  def init_properties
-    @properties.push(@confidentiality_requirement =
-                      CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
-                                       choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
-                                                 {name: 'Medium', abbreviation: 'M', weight: 1.0},
-                                                 {name: 'High', abbreviation: 'H', weight: 1.5},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-    @properties.push(@integrity_requirement =
-                      CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
-                                       choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
-                                                 {name: 'Medium', abbreviation: 'M', weight: 1.0},
-                                                 {name: 'High', abbreviation: 'H', weight: 1.5},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-
-    @properties.push(@availability_requirement =
-                      CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
-                                       choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
-                                                 {name: 'Medium', abbreviation: 'M', weight: 1.0},
-                                                 {name: 'High', abbreviation: 'H', weight: 1.5},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-    @properties.push(@modified_attack_vector =
-                      CvssProperty.new(name: 'Modified Attack Vector', abbreviation: 'MAV', position: [11, 14],
-                                       choices: [{name: 'Network', abbreviation: 'N', weight: 0.85},
-                                                 {name: 'Adjacent Network', abbreviation: 'A', weight: 0.62},
-                                                 {name: 'Local', abbreviation: 'L', weight: 0.55},
-                                                 {name: 'Physical', abbreviation: 'P', weight: 0.2},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-    @properties.push(@modified_attack_complexity =
-                      CvssProperty.new(name: 'Modified Attack Complexity', abbreviation: 'MAC', position: [12, 15],
-                                       choices: [{name: 'Low', abbreviation: 'L', weight: 0.77},
-                                                 {name: 'High', abbreviation: 'H', weight: 0.44},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-    @properties.push(@modified_privileges_required =
-                      CvssProperty.new(name: 'Modified Privileges Required', abbreviation: 'MPR', position: [13, 16],
-                                       choices: [{name: 'None', abbreviation: 'N', weight: 0.85},
-                                                 {name: 'Low', abbreviation: 'L', weight: 0.62},
-                                                 {name: 'High', abbreviation: 'H', weight: 0.27},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-    @properties.push(@modified_user_interaction =
-                      CvssProperty.new(name: 'Modified User Interaction', abbreviation: 'MUI', position: [14, 17],
-                                       choices: [{name: 'None', abbreviation: 'N', weight: 0.85},
-                                                 {name: 'Required', abbreviation: 'R', weight: 0.62},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-    @properties.push(@modified_scope =
-                      CvssProperty.new(name: 'Modified Scope', abbreviation: 'MS', position: [15, 18],
-                                       choices: [{name: 'Changed', abbreviation: 'C'},
-                                                 {name: 'Unchanged', abbreviation: 'U'}]))
-    @properties.push(@modified_confidentiality =
-                      CvssProperty.new(name: 'Modified Confidentiality', abbreviation: 'MC', position: [16, 19],
-                                       choices: [{name: 'None', abbreviation: 'N', weight: 0},
-                                                 {name: 'Low', abbreviation: 'L', weight: 0.22},
-                                                 {name: 'High', abbreviation: 'H', weight: 0.56},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-    @properties.push(@modified_integrity =
-                      CvssProperty.new(name: 'Modified Integrity', abbreviation: 'MI', position: [17, 20],
-                                       choices: [{name: 'None', abbreviation: 'N', weight: 0},
-                                                 {name: 'Low', abbreviation: 'L', weight: 0.22},
-                                                 {name: 'High', abbreviation: 'H', weight: 0.56},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-    @properties.push(@modified_availability =
-                      CvssProperty.new(name: 'Modified Availability', abbreviation: 'MA', position: [18, 21],
-                                       choices: [{name: 'None', abbreviation: 'N', weight: 0},
-                                                 {name: 'Low', abbreviation: 'L', weight: 0.22},
-                                                 {name: 'High', abbreviation: 'H', weight: 0.56},
-                                                 {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
-  end
+    private
+
+    def init_properties
+      @properties.push(@confidentiality_requirement =
+                         CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
+                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                    { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                    { name: 'High', abbreviation: 'H', weight: 1.5 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+      @properties.push(@integrity_requirement =
+                         CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
+                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                    { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                    { name: 'High', abbreviation: 'H', weight: 1.5 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+
+      @properties.push(@availability_requirement =
+                         CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
+                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                    { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                    { name: 'High', abbreviation: 'H', weight: 1.5 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+      @properties.push(@modified_attack_vector =
+                         CvssProperty.new(name: 'Modified Attack Vector', abbreviation: 'MAV', position: [11, 14],
+                                          choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
+                                                    { name: 'Adjacent Network', abbreviation: 'A', weight: 0.62 },
+                                                    { name: 'Local', abbreviation: 'L', weight: 0.55 },
+                                                    { name: 'Physical', abbreviation: 'P', weight: 0.2 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+      @properties.push(@modified_attack_complexity =
+                         CvssProperty.new(name: 'Modified Attack Complexity', abbreviation: 'MAC', position: [12, 15],
+                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.44 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+      @properties.push(@modified_privileges_required =
+                         CvssProperty.new(name: 'Modified Privileges Required', abbreviation: 'MPR', position: [13, 16],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.62 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.27 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+      @properties.push(@modified_user_interaction =
+                         CvssProperty.new(name: 'Modified User Interaction', abbreviation: 'MUI', position: [14, 17],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
+                                                    { name: 'Required', abbreviation: 'R', weight: 0.62 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+      @properties.push(@modified_scope =
+                         CvssProperty.new(name: 'Modified Scope', abbreviation: 'MS', position: [15, 18],
+                                          choices: [{ name: 'Changed', abbreviation: 'C' },
+                                                    { name: 'Unchanged', abbreviation: 'U' },
+                                                    { name: 'Not Defined', abbreviation: 'X' }]))
+      @properties.push(@modified_confidentiality =
+                         CvssProperty.new(name: 'Modified Confidentiality', abbreviation: 'MC', position: [16, 19],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.22 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.56 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+      @properties.push(@modified_integrity =
+                         CvssProperty.new(name: 'Modified Integrity', abbreviation: 'MI', position: [17, 20],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.22 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.56 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+      @properties.push(@modified_availability =
+                         CvssProperty.new(name: 'Modified Availability', abbreviation: 'MA', position: [18, 21],
+                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
+                                                    { name: 'Low', abbreviation: 'L', weight: 0.22 },
+                                                    { name: 'High', abbreviation: 'H', weight: 0.56 },
+                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
+    end
 
-  def modified_impact_sub(isc_modified)
-    if @modified_scope.selected_choice[:name] == 'Changed'
-      7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
-    else
-      6.42 * isc_modified
+    def modified_impact_sub(isc_modified)
+      if @modified_scope.selected_choice[:name] == 'Not Defined'
+        if @base.scope.selected_choice[:name] == 'Changed'
+          return 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
+        else
+          return 6.42 * isc_modified
+        end
+      end
+
+      if @modified_scope.selected_choice[:name] == 'Changed'
+        7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
+      else
+        6.42 * isc_modified
+      end
     end
-  end
 
-  def isc_modified
-    confidentiality_score = 1 - @modified_confidentiality.score * @confidentiality_requirement.score
-    integrity_score = 1 - @modified_integrity.score * @integrity_requirement.score
-    availability_score = 1 - @modified_availability.score * @availability_requirement.score
+    def isc_modified
+      merged_modified_confidentiality = @modified_confidentiality
+      if @modified_confidentiality.selected_choice[:name] == 'Not Defined'
+        merged_modified_confidentiality = @base.confidentiality
+      end
 
-    [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
-  end
+      merged_modified_integrity = @modified_integrity
+      if @modified_integrity.selected_choice[:name] == 'Not Defined'
+        merged_modified_integrity = @base.integrity
+      end
 
-  def modified_exploitability_sub(privilege_score)
-    modified_exploitability_sub_score = 8.22 * @modified_attack_vector.score
-    modified_exploitability_sub_score *= @modified_attack_complexity.score
-    modified_exploitability_sub_score *= privilege_score
-    modified_exploitability_sub_score *= @modified_user_interaction.score
-  end
+      merged_modified_availability = @modified_availability
+      if @modified_availability.selected_choice[:name] == 'Not Defined'
+        merged_modified_availability = @base.availability
+      end
 
-  def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
-    factor = @modified_scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
+      confidentiality_score = 1 - merged_modified_confidentiality.score * @confidentiality_requirement.score
+      integrity_score = 1 - merged_modified_integrity.score * @integrity_requirement.score
+      availability_score = 1 - merged_modified_availability.score * @availability_requirement.score
 
-    ([factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min.round_up(1) * temporal_score)
+      [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
+    end
 
+    def modified_exploitability_sub(privilege_score)
+      merged_modified_attack_vector = @modified_attack_vector
+      if @modified_attack_vector.selected_choice[:name] == 'Not Defined'
+        merged_modified_attack_vector = @base.attack_vector
+      end
+
+      merged_modified_attack_complexity = @modified_attack_complexity
+      if @modified_attack_complexity.selected_choice[:name] == 'Not Defined'
+        merged_modified_attack_complexity = @base.attack_complexity
+      end
+
+      merged_modified_user_interaction = @modified_user_interaction
+      if @modified_user_interaction.selected_choice[:name] == 'Not Defined'
+        merged_modified_user_interaction = @base.user_interaction
+      end
+
+      8.22 * merged_modified_attack_vector.score * merged_modified_attack_complexity.score *
+        privilege_score * merged_modified_user_interaction.score
+    end
+
+    def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
+      if @modified_scope.selected_choice[:name] == 'Not Defined'
+        factor = @base.scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
+      else
+        factor = @modified_scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
+      end
+
+      Cvss3Helper.round_up(
+        [factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min
+      ) * temporal_score
+    end
   end
-end
+end