cvss-suite 1.2.0 → 1.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (32) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/rspec.yml +23 -0
  3. data/.rubocop.yml +6 -1
  4. data/.rubocop_todo.yml +124 -0
  5. data/CHANGES.md +24 -0
  6. data/README.md +5 -2
  7. data/_config.yml +1 -0
  8. data/bin/console +3 -3
  9. data/cvss_suite.gemspec +13 -13
  10. data/lib/cvss_suite.rb +7 -8
  11. data/lib/cvss_suite/cvss.rb +81 -85
  12. data/lib/cvss_suite/cvss2/cvss2.rb +34 -26
  13. data/lib/cvss_suite/cvss2/cvss2_base.rb +70 -73
  14. data/lib/cvss_suite/cvss2/cvss2_environmental.rb +49 -50
  15. data/lib/cvss_suite/cvss2/cvss2_temporal.rb +41 -39
  16. data/lib/cvss_suite/cvss3/cvss3.rb +34 -26
  17. data/lib/cvss_suite/cvss3/cvss3_base.rb +64 -65
  18. data/lib/cvss_suite/cvss3/cvss3_environmental.rb +108 -111
  19. data/lib/cvss_suite/cvss3/cvss3_temporal.rb +42 -40
  20. data/lib/cvss_suite/cvss31/cvss31.rb +35 -26
  21. data/lib/cvss_suite/cvss31/cvss31_base.rb +64 -65
  22. data/lib/cvss_suite/cvss31/cvss31_environmental.rb +109 -111
  23. data/lib/cvss_suite/cvss31/cvss31_temporal.rb +42 -40
  24. data/lib/cvss_suite/cvss_metric.rb +31 -31
  25. data/lib/cvss_suite/cvss_property.rb +56 -54
  26. data/lib/cvss_suite/helpers/cvss31_helper.rb +27 -0
  27. data/lib/cvss_suite/helpers/cvss3_helper.rb +20 -13
  28. data/lib/cvss_suite/invalid_cvss.rb +31 -32
  29. data/lib/cvss_suite/version.rb +1 -1
  30. metadata +10 -22
  31. data/.travis.yml +0 -4
  32. data/lib/cvss_suite/helpers/extensions.rb +0 -56
data/lib/cvss_suite/cvss3/cvss3_base.rb CHANGED
@@ -15,81 +15,80 @@ require_relative '../helpers/cvss3_helper'
15
15
  ##
16
16
  # This class represents a CVSS Base metric in version 3.
17
17
 
18
- class Cvss3Base < CvssMetric
18
+ module CvssSuite
19
+ class Cvss3Base < CvssMetric
20
+ ##
21
+ # Property of this metric
19
22
 
20
- ##
21
- # Property of this metric
23
+ attr_reader :attack_vector, :attack_complexity, :privileges_required, :user_interaction,
24
+ :scope, :confidentiality, :integrity, :availability
22
25
 
23
- attr_reader :attack_vector, :attack_complexity, :privileges_required, :user_interaction,
24
- :scope, :confidentiality, :integrity, :availability
26
+ ##
27
+ # Returns score of this metric
25
28
 
26
- ##
27
- # Returns score of this metric
29
+ def score
30
+ privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
28
31
 
29
- def score
32
+ exploitability = 8.22 * @attack_vector.score * @attack_complexity.score * privilege_score * @user_interaction.score
30
33
 
31
- privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
34
+ isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
32
35
 
33
- exploitability = 8.22 * @attack_vector.score * @attack_complexity.score * privilege_score * @user_interaction.score
36
+ impact_sub_score = if @scope.selected_choice[:name] == 'Changed'
37
+ 7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
38
+ else
39
+ 6.42 * isc_base
40
+ end
34
41
 
35
- isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
42
+ return 0 if impact_sub_score <= 0
36
43
 
37
- if @scope.selected_choice[:name] == 'Changed'
38
- impact_sub_score = 7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
39
- else
40
- impact_sub_score = 6.42 * isc_base
44
+ if @scope.selected_choice[:name] == 'Changed'
45
+ [10, 1.08 * (impact_sub_score + exploitability)].min
46
+ else
47
+ [10, impact_sub_score + exploitability].min
48
+ end
41
49
  end
42
50
 
43
- return 0 if impact_sub_score <= 0
44
-
45
- if @scope.selected_choice[:name] == 'Changed'
46
- [10, 1.08 * (impact_sub_score + exploitability)].min
47
- else
48
- [10, impact_sub_score + exploitability].min
51
+ private
52
+
53
+ def init_properties
54
+ @properties.push(@attack_vector =
55
+ CvssProperty.new(name: 'Attack Vector', abbreviation: 'AV', position: [0],
56
+ choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
57
+ { name: 'Adjacent', abbreviation: 'A', weight: 0.62 },
58
+ { name: 'Local', abbreviation: 'L', weight: 0.55 },
59
+ { name: 'Physical', abbreviation: 'P', weight: 0.2 }]))
60
+ @properties.push(@attack_complexity =
61
+ CvssProperty.new(name: 'Attack Complexity', abbreviation: 'AC', position: [1],
62
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
63
+ { name: 'High', abbreviation: 'H', weight: 0.44 }]))
64
+ @properties.push(@privileges_required =
65
+ CvssProperty.new(name: 'Privileges Required', abbreviation: 'PR', position: [2],
66
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
67
+ { name: 'Low', abbreviation: 'L', weight: 0.62 },
68
+ { name: 'High', abbreviation: 'H', weight: 0.27 }]))
69
+ @properties.push(@user_interaction =
70
+ CvssProperty.new(name: 'User Interaction', abbreviation: 'UI', position: [3],
71
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
72
+ { name: 'Required', abbreviation: 'R', weight: 0.62 }]))
73
+ @properties.push(@scope =
74
+ CvssProperty.new(name: 'Scope', abbreviation: 'S', position: [4],
75
+ choices: [{ name: 'Unchanged', abbreviation: 'U' },
76
+ { name: 'Changed', abbreviation: 'C' }]))
77
+ @properties.push(@confidentiality =
78
+ CvssProperty.new(name: 'Confidentiality', abbreviation: 'C', position: [5],
79
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
80
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
81
+ { name: 'High', abbreviation: 'H', weight: 0.56 }]))
82
+ @properties.push(@integrity =
83
+ CvssProperty.new(name: 'Integrity', abbreviation: 'I', position: [6],
84
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
85
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
86
+ { name: 'High', abbreviation: 'H', weight: 0.56 }]))
87
+ @properties.push(@availability =
88
+ CvssProperty.new(name: 'Availability', abbreviation: 'A', position: [7],
89
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
90
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
91
+ { name: 'High', abbreviation: 'H', weight: 0.56 }]))
49
92
  end
50
93
  end
51
-
52
- private
53
-
54
- def init_properties
55
- @properties.push(@attack_vector =
56
- CvssProperty.new(name: 'Attack Vector', abbreviation: 'AV', position: [0],
57
- choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
58
- { name: 'Adjacent', abbreviation: 'A', weight: 0.62 },
59
- { name: 'Local', abbreviation: 'L', weight: 0.55 },
60
- { name: 'Physical', abbreviation: 'P', weight: 0.2 }]))
61
- @properties.push(@attack_complexity =
62
- CvssProperty.new(name: 'Attack Complexity', abbreviation: 'AC', position: [1],
63
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
64
- { name: 'High', abbreviation: 'H', weight: 0.44 }]))
65
- @properties.push(@privileges_required =
66
- CvssProperty.new(name: 'Privileges Required', abbreviation: 'PR', position: [2],
67
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
68
- { name: 'Low', abbreviation: 'L', weight: 0.62 },
69
- { name: 'High', abbreviation: 'H', weight: 0.27 }]))
70
- @properties.push(@user_interaction =
71
- CvssProperty.new(name: 'User Interaction', abbreviation: 'UI', position: [3],
72
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
73
- { name: 'Required', abbreviation: 'R', weight: 0.62 }]))
74
- @properties.push(@scope =
75
- CvssProperty.new(name: 'Scope', abbreviation: 'S', position: [4],
76
- choices: [{ name: 'Unchanged', abbreviation: 'U' },
77
- { name: 'Changed', abbreviation: 'C' }]))
78
- @properties.push(@confidentiality =
79
- CvssProperty.new(name: 'Confidentiality', abbreviation: 'C', position: [5],
80
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
81
- { name: 'Low', abbreviation: 'L', weight: 0.22 },
82
- { name: 'High', abbreviation: 'H', weight: 0.56 }]))
83
- @properties.push(@integrity =
84
- CvssProperty.new(name: 'Integrity', abbreviation: 'I', position: [6],
85
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
86
- { name: 'Low', abbreviation: 'L', weight: 0.22 },
87
- { name: 'High', abbreviation: 'H', weight: 0.56 }]))
88
- @properties.push(@availability =
89
- CvssProperty.new(name: 'Availability', abbreviation: 'A', position: [7],
90
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
91
- { name: 'Low', abbreviation: 'L', weight: 0.22 },
92
- { name: 'High', abbreviation: 'H', weight: 0.56 }]))
93
- end
94
94
  end
95
-
data/lib/cvss_suite/cvss3/cvss3_environmental.rb CHANGED
@@ -15,130 +15,127 @@ require_relative '../helpers/cvss3_helper'
15
15
  ##
16
16
  # This class represents a CVSS Environmental metric in version 3.
17
17
 
18
- class Cvss3Environmental < CvssMetric
18
+ module CvssSuite
19
+ class Cvss3Environmental < CvssMetric
20
+ ##
21
+ # Property of this metric
19
22
 
20
- ##
21
- # Property of this metric
23
+ attr_reader :confidentiality_requirement, :integrity_requirement, :availability_requirement,
24
+ :modified_attack_vector, :modified_attack_complexity, :modified_privileges_required,
25
+ :modified_user_interaction, :modified_scope, :modified_confidentiality,
26
+ :modified_integrity, :modified_availability
22
27
 
23
- attr_reader :confidentiality_requirement, :integrity_requirement, :availability_requirement,
24
- :modified_attack_vector, :modified_attack_complexity, :modified_privileges_required,
25
- :modified_user_interaction, :modified_scope, :modified_confidentiality,
26
- :modified_integrity, :modified_availability
28
+ ##
29
+ # Returns score of this metric
27
30
 
28
- ##
29
- # Returns score of this metric
31
+ def score(temporal_score)
32
+ privilege_score = Cvss3Helper.privileges_required_score(@modified_privileges_required, @modified_scope)
30
33
 
31
- def score(temporal_score)
34
+ modified_exploitability_sub_score = modified_exploitability_sub(privilege_score)
32
35
 
33
- privilege_score = Cvss3Helper.privileges_required_score @modified_privileges_required, @modified_scope
36
+ modified_impact_sub_score = modified_impact_sub(isc_modified)
34
37
 
35
- modified_exploitability_sub_score = modified_exploitability_sub privilege_score
38
+ return 0 if modified_impact_sub_score <= 0
36
39
 
37
- isc_modified_score = isc_modified
38
-
39
- modified_impact_sub_score = modified_impact_sub isc_modified_score
40
-
41
- return 0 if modified_impact_sub_score <= 0
42
-
43
- calculate_score modified_impact_sub_score, modified_exploitability_sub_score, temporal_score
44
- end
45
-
46
- private
47
-
48
- def init_properties
49
- @properties.push(@confidentiality_requirement =
50
- CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
51
- choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
52
- {name: 'Medium', abbreviation: 'M', weight: 1.0},
53
- {name: 'High', abbreviation: 'H', weight: 1.5},
54
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
55
- @properties.push(@integrity_requirement =
56
- CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
57
- choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
58
- {name: 'Medium', abbreviation: 'M', weight: 1.0},
59
- {name: 'High', abbreviation: 'H', weight: 1.5},
60
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
61
-
62
- @properties.push(@availability_requirement =
63
- CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
64
- choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
65
- {name: 'Medium', abbreviation: 'M', weight: 1.0},
66
- {name: 'High', abbreviation: 'H', weight: 1.5},
67
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
68
- @properties.push(@modified_attack_vector =
69
- CvssProperty.new(name: 'Modified Attack Vector', abbreviation: 'MAV', position: [11, 14],
70
- choices: [{name: 'Network', abbreviation: 'N', weight: 0.85},
71
- {name: 'Adjacent Network', abbreviation: 'A', weight: 0.62},
72
- {name: 'Local', abbreviation: 'L', weight: 0.55},
73
- {name: 'Physical', abbreviation: 'P', weight: 0.2},
74
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
75
- @properties.push(@modified_attack_complexity =
76
- CvssProperty.new(name: 'Modified Attack Complexity', abbreviation: 'MAC', position: [12, 15],
77
- choices: [{name: 'Low', abbreviation: 'L', weight: 0.77},
78
- {name: 'High', abbreviation: 'H', weight: 0.44},
79
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
80
- @properties.push(@modified_privileges_required =
81
- CvssProperty.new(name: 'Modified Privileges Required', abbreviation: 'MPR', position: [13, 16],
82
- choices: [{name: 'None', abbreviation: 'N', weight: 0.85},
83
- {name: 'Low', abbreviation: 'L', weight: 0.62},
84
- {name: 'High', abbreviation: 'H', weight: 0.27},
85
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
86
- @properties.push(@modified_user_interaction =
87
- CvssProperty.new(name: 'Modified User Interaction', abbreviation: 'MUI', position: [14, 17],
88
- choices: [{name: 'None', abbreviation: 'N', weight: 0.85},
89
- {name: 'Required', abbreviation: 'R', weight: 0.62},
90
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
91
- @properties.push(@modified_scope =
92
- CvssProperty.new(name: 'Modified Scope', abbreviation: 'MS', position: [15, 18],
93
- choices: [{name: 'Changed', abbreviation: 'C'},
94
- {name: 'Unchanged', abbreviation: 'U'}]))
95
- @properties.push(@modified_confidentiality =
96
- CvssProperty.new(name: 'Modified Confidentiality', abbreviation: 'MC', position: [16, 19],
97
- choices: [{name: 'None', abbreviation: 'N', weight: 0},
98
- {name: 'Low', abbreviation: 'L', weight: 0.22},
99
- {name: 'High', abbreviation: 'H', weight: 0.56},
100
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
101
- @properties.push(@modified_integrity =
102
- CvssProperty.new(name: 'Modified Integrity', abbreviation: 'MI', position: [17, 20],
103
- choices: [{name: 'None', abbreviation: 'N', weight: 0},
104
- {name: 'Low', abbreviation: 'L', weight: 0.22},
105
- {name: 'High', abbreviation: 'H', weight: 0.56},
106
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
107
- @properties.push(@modified_availability =
108
- CvssProperty.new(name: 'Modified Availability', abbreviation: 'MA', position: [18, 21],
109
- choices: [{name: 'None', abbreviation: 'N', weight: 0},
110
- {name: 'Low', abbreviation: 'L', weight: 0.22},
111
- {name: 'High', abbreviation: 'H', weight: 0.56},
112
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
113
- end
40
+ calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
41
+ end
114
42
 
115
- def modified_impact_sub(isc_modified)
116
- if @modified_scope.selected_choice[:name] == 'Changed'
117
- 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
118
- else
119
- 6.42 * isc_modified
43
+ private
44
+
45
+ def init_properties
46
+ @properties.push(@confidentiality_requirement =
47
+ CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
48
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
49
+ { name: 'Medium', abbreviation: 'M', weight: 1.0 },
50
+ { name: 'High', abbreviation: 'H', weight: 1.5 },
51
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
52
+ @properties.push(@integrity_requirement =
53
+ CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
54
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
55
+ { name: 'Medium', abbreviation: 'M', weight: 1.0 },
56
+ { name: 'High', abbreviation: 'H', weight: 1.5 },
57
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
58
+
59
+ @properties.push(@availability_requirement =
60
+ CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
61
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
62
+ { name: 'Medium', abbreviation: 'M', weight: 1.0 },
63
+ { name: 'High', abbreviation: 'H', weight: 1.5 },
64
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
65
+ @properties.push(@modified_attack_vector =
66
+ CvssProperty.new(name: 'Modified Attack Vector', abbreviation: 'MAV', position: [11, 14],
67
+ choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
68
+ { name: 'Adjacent Network', abbreviation: 'A', weight: 0.62 },
69
+ { name: 'Local', abbreviation: 'L', weight: 0.55 },
70
+ { name: 'Physical', abbreviation: 'P', weight: 0.2 },
71
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
72
+ @properties.push(@modified_attack_complexity =
73
+ CvssProperty.new(name: 'Modified Attack Complexity', abbreviation: 'MAC', position: [12, 15],
74
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
75
+ { name: 'High', abbreviation: 'H', weight: 0.44 },
76
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
77
+ @properties.push(@modified_privileges_required =
78
+ CvssProperty.new(name: 'Modified Privileges Required', abbreviation: 'MPR', position: [13, 16],
79
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
80
+ { name: 'Low', abbreviation: 'L', weight: 0.62 },
81
+ { name: 'High', abbreviation: 'H', weight: 0.27 },
82
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
83
+ @properties.push(@modified_user_interaction =
84
+ CvssProperty.new(name: 'Modified User Interaction', abbreviation: 'MUI', position: [14, 17],
85
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
86
+ { name: 'Required', abbreviation: 'R', weight: 0.62 },
87
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
88
+ @properties.push(@modified_scope =
89
+ CvssProperty.new(name: 'Modified Scope', abbreviation: 'MS', position: [15, 18],
90
+ choices: [{ name: 'Changed', abbreviation: 'C' },
91
+ { name: 'Unchanged', abbreviation: 'U' }]))
92
+ @properties.push(@modified_confidentiality =
93
+ CvssProperty.new(name: 'Modified Confidentiality', abbreviation: 'MC', position: [16, 19],
94
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
95
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
96
+ { name: 'High', abbreviation: 'H', weight: 0.56 },
97
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
98
+ @properties.push(@modified_integrity =
99
+ CvssProperty.new(name: 'Modified Integrity', abbreviation: 'MI', position: [17, 20],
100
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
101
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
102
+ { name: 'High', abbreviation: 'H', weight: 0.56 },
103
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
104
+ @properties.push(@modified_availability =
105
+ CvssProperty.new(name: 'Modified Availability', abbreviation: 'MA', position: [18, 21],
106
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
107
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
108
+ { name: 'High', abbreviation: 'H', weight: 0.56 },
109
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
120
110
  end
121
- end
122
111
 
123
- def isc_modified
124
- confidentiality_score = 1 - @modified_confidentiality.score * @confidentiality_requirement.score
125
- integrity_score = 1 - @modified_integrity.score * @integrity_requirement.score
126
- availability_score = 1 - @modified_availability.score * @availability_requirement.score
112
+ def modified_impact_sub(isc_modified)
113
+ if @modified_scope.selected_choice[:name] == 'Changed'
114
+ 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
115
+ else
116
+ 6.42 * isc_modified
117
+ end
118
+ end
127
119
 
128
- [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
129
- end
120
+ def isc_modified
121
+ confidentiality_score = 1 - @modified_confidentiality.score * @confidentiality_requirement.score
122
+ integrity_score = 1 - @modified_integrity.score * @integrity_requirement.score
123
+ availability_score = 1 - @modified_availability.score * @availability_requirement.score
130
124
 
131
- def modified_exploitability_sub(privilege_score)
132
- modified_exploitability_sub_score = 8.22 * @modified_attack_vector.score
133
- modified_exploitability_sub_score *= @modified_attack_complexity.score
134
- modified_exploitability_sub_score *= privilege_score
135
- modified_exploitability_sub_score *= @modified_user_interaction.score
136
- end
125
+ [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
126
+ end
137
127
 
138
- def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
139
- factor = @modified_scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
128
+ def modified_exploitability_sub(privilege_score)
129
+ 8.22 * @modified_attack_vector.score * @modified_attack_complexity.score *
130
+ privilege_score * @modified_user_interaction.score
131
+ end
140
132
 
141
- ([factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min.round_up(1) * temporal_score)
133
+ def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
134
+ factor = @modified_scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
142
135
 
136
+ Cvss3Helper.round_up(
137
+ [factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min
138
+ ) * temporal_score
139
+ end
143
140
  end
144
- end
141
+ end
data/lib/cvss_suite/cvss3/cvss3_temporal.rb CHANGED
@@ -14,44 +14,46 @@ require_relative '../cvss_metric'
14
14
  ##
15
15
  # This class represents a CVSS Temporal metric in version 3.
16
16
 
17
- class Cvss3Temporal < CvssMetric
18
-
19
- ##
20
- # Property of this metric
21
-
22
- attr_reader :exploit_code_maturity, :remediation_level, :report_confidence
23
-
24
- ##
25
- # Returns score of this metric
26
-
27
- def score
28
- return 1.0 unless valid?
29
- @exploit_code_maturity.score * @remediation_level.score * @report_confidence.score
30
- end
31
-
32
- private
33
-
34
- def init_properties
35
- @properties.push(@exploit_code_maturity =
36
- CvssProperty.new(name: 'Exploit Code Maturity', abbreviation: 'E', position: [8],
37
- choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
38
- { name: 'Unproven', abbreviation: 'U', weight: 0.91 },
39
- { name: 'Proof-of-Concept', abbreviation: 'P', weight: 0.94 },
40
- { name: 'Functional', abbreviation: 'F', weight: 0.97 },
41
- { name: 'High', abbreviation: 'H', weight: 1.0 }]))
42
- @properties.push(@remediation_level =
43
- CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [9],
44
- choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
45
- { name: 'Official Fix', abbreviation: 'O', weight: 0.95 },
46
- { name: 'Temporary Fix', abbreviation: 'T', weight: 0.96 },
47
- { name: 'Workaround', abbreviation: 'W', weight: 0.97 },
48
- { name: 'Unavailable', abbreviation: 'U', weight: 1.0 }]))
49
-
50
- @properties.push(@report_confidence =
51
- CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [10],
52
- choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
53
- { name: 'Unknown', abbreviation: 'U', weight: 0.92 },
54
- { name: 'Reasonable', abbreviation: 'R', weight: 0.96 },
55
- { name: 'Confirmed', abbreviation: 'C', weight: 1.0 }]))
17
+ module CvssSuite
18
+ class Cvss3Temporal < CvssMetric
19
+ ##
20
+ # Property of this metric
21
+
22
+ attr_reader :exploit_code_maturity, :remediation_level, :report_confidence
23
+
24
+ ##
25
+ # Returns score of this metric
26
+
27
+ def score
28
+ return 1.0 unless valid?
29
+
30
+ @exploit_code_maturity.score * @remediation_level.score * @report_confidence.score
31
+ end
32
+
33
+ private
34
+
35
+ def init_properties
36
+ @properties.push(@exploit_code_maturity =
37
+ CvssProperty.new(name: 'Exploit Code Maturity', abbreviation: 'E', position: [8],
38
+ choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
39
+ { name: 'Unproven', abbreviation: 'U', weight: 0.91 },
40
+ { name: 'Proof-of-Concept', abbreviation: 'P', weight: 0.94 },
41
+ { name: 'Functional', abbreviation: 'F', weight: 0.97 },
42
+ { name: 'High', abbreviation: 'H', weight: 1.0 }]))
43
+ @properties.push(@remediation_level =
44
+ CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [9],
45
+ choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
46
+ { name: 'Official Fix', abbreviation: 'O', weight: 0.95 },
47
+ { name: 'Temporary Fix', abbreviation: 'T', weight: 0.96 },
48
+ { name: 'Workaround', abbreviation: 'W', weight: 0.97 },
49
+ { name: 'Unavailable', abbreviation: 'U', weight: 1.0 }]))
50
+
51
+ @properties.push(@report_confidence =
52
+ CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [10],
53
+ choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
54
+ { name: 'Unknown', abbreviation: 'U', weight: 0.92 },
55
+ { name: 'Reasonable', abbreviation: 'R', weight: 0.96 },
56
+ { name: 'Confirmed', abbreviation: 'C', weight: 1.0 }]))
57
+ end
56
58
  end
57
- end
59
+ end