cvss-suite 1.2.0 → 1.2.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (32) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/rspec.yml +23 -0
  3. data/.rubocop.yml +6 -1
  4. data/.rubocop_todo.yml +124 -0
  5. data/CHANGES.md +24 -0
  6. data/README.md +5 -2
  7. data/_config.yml +1 -0
  8. data/bin/console +3 -3
  9. data/cvss_suite.gemspec +13 -13
  10. data/lib/cvss_suite.rb +7 -8
  11. data/lib/cvss_suite/cvss.rb +81 -85
  12. data/lib/cvss_suite/cvss2/cvss2.rb +34 -26
  13. data/lib/cvss_suite/cvss2/cvss2_base.rb +70 -73
  14. data/lib/cvss_suite/cvss2/cvss2_environmental.rb +49 -50
  15. data/lib/cvss_suite/cvss2/cvss2_temporal.rb +41 -39
  16. data/lib/cvss_suite/cvss3/cvss3.rb +34 -26
  17. data/lib/cvss_suite/cvss3/cvss3_base.rb +64 -65
  18. data/lib/cvss_suite/cvss3/cvss3_environmental.rb +108 -111
  19. data/lib/cvss_suite/cvss3/cvss3_temporal.rb +42 -40
  20. data/lib/cvss_suite/cvss31/cvss31.rb +35 -26
  21. data/lib/cvss_suite/cvss31/cvss31_base.rb +64 -65
  22. data/lib/cvss_suite/cvss31/cvss31_environmental.rb +109 -111
  23. data/lib/cvss_suite/cvss31/cvss31_temporal.rb +42 -40
  24. data/lib/cvss_suite/cvss_metric.rb +31 -31
  25. data/lib/cvss_suite/cvss_property.rb +56 -54
  26. data/lib/cvss_suite/helpers/cvss31_helper.rb +27 -0
  27. data/lib/cvss_suite/helpers/cvss3_helper.rb +20 -13
  28. data/lib/cvss_suite/invalid_cvss.rb +31 -32
  29. data/lib/cvss_suite/version.rb +1 -1
  30. metadata +10 -22
  31. data/.travis.yml +0 -4
  32. data/lib/cvss_suite/helpers/extensions.rb +0 -56
data/lib/cvss_suite/cvss3/cvss3_base.rb CHANGED
@@ -15,81 +15,80 @@ require_relative '../helpers/cvss3_helper'
15
15
  ##
16
16
  # This class represents a CVSS Base metric in version 3.
17
17
 
18
- class Cvss3Base < CvssMetric
18
+ module CvssSuite
19
+ class Cvss3Base < CvssMetric
20
+ ##
21
+ # Property of this metric
19
22
 
20
- ##
21
- # Property of this metric
23
+ attr_reader :attack_vector, :attack_complexity, :privileges_required, :user_interaction,
24
+ :scope, :confidentiality, :integrity, :availability
22
25
 
23
- attr_reader :attack_vector, :attack_complexity, :privileges_required, :user_interaction,
24
- :scope, :confidentiality, :integrity, :availability
26
+ ##
27
+ # Returns score of this metric
25
28
 
26
- ##
27
- # Returns score of this metric
29
+ def score
30
+ privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
28
31
 
29
- def score
32
+ exploitability = 8.22 * @attack_vector.score * @attack_complexity.score * privilege_score * @user_interaction.score
30
33
 
31
- privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
34
+ isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
32
35
 
33
- exploitability = 8.22 * @attack_vector.score * @attack_complexity.score * privilege_score * @user_interaction.score
36
+ impact_sub_score = if @scope.selected_choice[:name] == 'Changed'
37
+ 7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
38
+ else
39
+ 6.42 * isc_base
40
+ end
34
41
 
35
- isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
42
+ return 0 if impact_sub_score <= 0
36
43
 
37
- if @scope.selected_choice[:name] == 'Changed'
38
- impact_sub_score = 7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
39
- else
40
- impact_sub_score = 6.42 * isc_base
44
+ if @scope.selected_choice[:name] == 'Changed'
45
+ [10, 1.08 * (impact_sub_score + exploitability)].min
46
+ else
47
+ [10, impact_sub_score + exploitability].min
48
+ end
41
49
  end
42
50
 
43
- return 0 if impact_sub_score <= 0
44
-
45
- if @scope.selected_choice[:name] == 'Changed'
46
- [10, 1.08 * (impact_sub_score + exploitability)].min
47
- else
48
- [10, impact_sub_score + exploitability].min
51
+ private
52
+
53
+ def init_properties
54
+ @properties.push(@attack_vector =
55
+ CvssProperty.new(name: 'Attack Vector', abbreviation: 'AV', position: [0],
56
+ choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
57
+ { name: 'Adjacent', abbreviation: 'A', weight: 0.62 },
58
+ { name: 'Local', abbreviation: 'L', weight: 0.55 },
59
+ { name: 'Physical', abbreviation: 'P', weight: 0.2 }]))
60
+ @properties.push(@attack_complexity =
61
+ CvssProperty.new(name: 'Attack Complexity', abbreviation: 'AC', position: [1],
62
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
63
+ { name: 'High', abbreviation: 'H', weight: 0.44 }]))
64
+ @properties.push(@privileges_required =
65
+ CvssProperty.new(name: 'Privileges Required', abbreviation: 'PR', position: [2],
66
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
67
+ { name: 'Low', abbreviation: 'L', weight: 0.62 },
68
+ { name: 'High', abbreviation: 'H', weight: 0.27 }]))
69
+ @properties.push(@user_interaction =
70
+ CvssProperty.new(name: 'User Interaction', abbreviation: 'UI', position: [3],
71
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
72
+ { name: 'Required', abbreviation: 'R', weight: 0.62 }]))
73
+ @properties.push(@scope =
74
+ CvssProperty.new(name: 'Scope', abbreviation: 'S', position: [4],
75
+ choices: [{ name: 'Unchanged', abbreviation: 'U' },
76
+ { name: 'Changed', abbreviation: 'C' }]))
77
+ @properties.push(@confidentiality =
78
+ CvssProperty.new(name: 'Confidentiality', abbreviation: 'C', position: [5],
79
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
80
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
81
+ { name: 'High', abbreviation: 'H', weight: 0.56 }]))
82
+ @properties.push(@integrity =
83
+ CvssProperty.new(name: 'Integrity', abbreviation: 'I', position: [6],
84
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
85
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
86
+ { name: 'High', abbreviation: 'H', weight: 0.56 }]))
87
+ @properties.push(@availability =
88
+ CvssProperty.new(name: 'Availability', abbreviation: 'A', position: [7],
89
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
90
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
91
+ { name: 'High', abbreviation: 'H', weight: 0.56 }]))
49
92
  end
50
93
  end
51
-
52
- private
53
-
54
- def init_properties
55
- @properties.push(@attack_vector =
56
- CvssProperty.new(name: 'Attack Vector', abbreviation: 'AV', position: [0],
57
- choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
58
- { name: 'Adjacent', abbreviation: 'A', weight: 0.62 },
59
- { name: 'Local', abbreviation: 'L', weight: 0.55 },
60
- { name: 'Physical', abbreviation: 'P', weight: 0.2 }]))
61
- @properties.push(@attack_complexity =
62
- CvssProperty.new(name: 'Attack Complexity', abbreviation: 'AC', position: [1],
63
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
64
- { name: 'High', abbreviation: 'H', weight: 0.44 }]))
65
- @properties.push(@privileges_required =
66
- CvssProperty.new(name: 'Privileges Required', abbreviation: 'PR', position: [2],
67
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
68
- { name: 'Low', abbreviation: 'L', weight: 0.62 },
69
- { name: 'High', abbreviation: 'H', weight: 0.27 }]))
70
- @properties.push(@user_interaction =
71
- CvssProperty.new(name: 'User Interaction', abbreviation: 'UI', position: [3],
72
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
73
- { name: 'Required', abbreviation: 'R', weight: 0.62 }]))
74
- @properties.push(@scope =
75
- CvssProperty.new(name: 'Scope', abbreviation: 'S', position: [4],
76
- choices: [{ name: 'Unchanged', abbreviation: 'U' },
77
- { name: 'Changed', abbreviation: 'C' }]))
78
- @properties.push(@confidentiality =
79
- CvssProperty.new(name: 'Confidentiality', abbreviation: 'C', position: [5],
80
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
81
- { name: 'Low', abbreviation: 'L', weight: 0.22 },
82
- { name: 'High', abbreviation: 'H', weight: 0.56 }]))
83
- @properties.push(@integrity =
84
- CvssProperty.new(name: 'Integrity', abbreviation: 'I', position: [6],
85
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
86
- { name: 'Low', abbreviation: 'L', weight: 0.22 },
87
- { name: 'High', abbreviation: 'H', weight: 0.56 }]))
88
- @properties.push(@availability =
89
- CvssProperty.new(name: 'Availability', abbreviation: 'A', position: [7],
90
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
91
- { name: 'Low', abbreviation: 'L', weight: 0.22 },
92
- { name: 'High', abbreviation: 'H', weight: 0.56 }]))
93
- end
94
94
  end
95
-
data/lib/cvss_suite/cvss3/cvss3_environmental.rb CHANGED
@@ -15,130 +15,127 @@ require_relative '../helpers/cvss3_helper'
15
15
  ##
16
16
  # This class represents a CVSS Environmental metric in version 3.
17
17
 
18
- class Cvss3Environmental < CvssMetric
18
+ module CvssSuite
19
+ class Cvss3Environmental < CvssMetric
20
+ ##
21
+ # Property of this metric
19
22
 
20
- ##
21
- # Property of this metric
23
+ attr_reader :confidentiality_requirement, :integrity_requirement, :availability_requirement,
24
+ :modified_attack_vector, :modified_attack_complexity, :modified_privileges_required,
25
+ :modified_user_interaction, :modified_scope, :modified_confidentiality,
26
+ :modified_integrity, :modified_availability
22
27
 
23
- attr_reader :confidentiality_requirement, :integrity_requirement, :availability_requirement,
24
- :modified_attack_vector, :modified_attack_complexity, :modified_privileges_required,
25
- :modified_user_interaction, :modified_scope, :modified_confidentiality,
26
- :modified_integrity, :modified_availability
28
+ ##
29
+ # Returns score of this metric
27
30
 
28
- ##
29
- # Returns score of this metric
31
+ def score(temporal_score)
32
+ privilege_score = Cvss3Helper.privileges_required_score(@modified_privileges_required, @modified_scope)
30
33
 
31
- def score(temporal_score)
34
+ modified_exploitability_sub_score = modified_exploitability_sub(privilege_score)
32
35
 
33
- privilege_score = Cvss3Helper.privileges_required_score @modified_privileges_required, @modified_scope
36
+ modified_impact_sub_score = modified_impact_sub(isc_modified)
34
37
 
35
- modified_exploitability_sub_score = modified_exploitability_sub privilege_score
38
+ return 0 if modified_impact_sub_score <= 0
36
39
 
37
- isc_modified_score = isc_modified
38
-
39
- modified_impact_sub_score = modified_impact_sub isc_modified_score
40
-
41
- return 0 if modified_impact_sub_score <= 0
42
-
43
- calculate_score modified_impact_sub_score, modified_exploitability_sub_score, temporal_score
44
- end
45
-
46
- private
47
-
48
- def init_properties
49
- @properties.push(@confidentiality_requirement =
50
- CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
51
- choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
52
- {name: 'Medium', abbreviation: 'M', weight: 1.0},
53
- {name: 'High', abbreviation: 'H', weight: 1.5},
54
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
55
- @properties.push(@integrity_requirement =
56
- CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
57
- choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
58
- {name: 'Medium', abbreviation: 'M', weight: 1.0},
59
- {name: 'High', abbreviation: 'H', weight: 1.5},
60
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
61
-
62
- @properties.push(@availability_requirement =
63
- CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
64
- choices: [{name: 'Low', abbreviation: 'L', weight: 0.5},
65
- {name: 'Medium', abbreviation: 'M', weight: 1.0},
66
- {name: 'High', abbreviation: 'H', weight: 1.5},
67
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
68
- @properties.push(@modified_attack_vector =
69
- CvssProperty.new(name: 'Modified Attack Vector', abbreviation: 'MAV', position: [11, 14],
70
- choices: [{name: 'Network', abbreviation: 'N', weight: 0.85},
71
- {name: 'Adjacent Network', abbreviation: 'A', weight: 0.62},
72
- {name: 'Local', abbreviation: 'L', weight: 0.55},
73
- {name: 'Physical', abbreviation: 'P', weight: 0.2},
74
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
75
- @properties.push(@modified_attack_complexity =
76
- CvssProperty.new(name: 'Modified Attack Complexity', abbreviation: 'MAC', position: [12, 15],
77
- choices: [{name: 'Low', abbreviation: 'L', weight: 0.77},
78
- {name: 'High', abbreviation: 'H', weight: 0.44},
79
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
80
- @properties.push(@modified_privileges_required =
81
- CvssProperty.new(name: 'Modified Privileges Required', abbreviation: 'MPR', position: [13, 16],
82
- choices: [{name: 'None', abbreviation: 'N', weight: 0.85},
83
- {name: 'Low', abbreviation: 'L', weight: 0.62},
84
- {name: 'High', abbreviation: 'H', weight: 0.27},
85
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
86
- @properties.push(@modified_user_interaction =
87
- CvssProperty.new(name: 'Modified User Interaction', abbreviation: 'MUI', position: [14, 17],
88
- choices: [{name: 'None', abbreviation: 'N', weight: 0.85},
89
- {name: 'Required', abbreviation: 'R', weight: 0.62},
90
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
91
- @properties.push(@modified_scope =
92
- CvssProperty.new(name: 'Modified Scope', abbreviation: 'MS', position: [15, 18],
93
- choices: [{name: 'Changed', abbreviation: 'C'},
94
- {name: 'Unchanged', abbreviation: 'U'}]))
95
- @properties.push(@modified_confidentiality =
96
- CvssProperty.new(name: 'Modified Confidentiality', abbreviation: 'MC', position: [16, 19],
97
- choices: [{name: 'None', abbreviation: 'N', weight: 0},
98
- {name: 'Low', abbreviation: 'L', weight: 0.22},
99
- {name: 'High', abbreviation: 'H', weight: 0.56},
100
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
101
- @properties.push(@modified_integrity =
102
- CvssProperty.new(name: 'Modified Integrity', abbreviation: 'MI', position: [17, 20],
103
- choices: [{name: 'None', abbreviation: 'N', weight: 0},
104
- {name: 'Low', abbreviation: 'L', weight: 0.22},
105
- {name: 'High', abbreviation: 'H', weight: 0.56},
106
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
107
- @properties.push(@modified_availability =
108
- CvssProperty.new(name: 'Modified Availability', abbreviation: 'MA', position: [18, 21],
109
- choices: [{name: 'None', abbreviation: 'N', weight: 0},
110
- {name: 'Low', abbreviation: 'L', weight: 0.22},
111
- {name: 'High', abbreviation: 'H', weight: 0.56},
112
- {name: 'Not Defined', abbreviation: 'X', weight: 1}]))
113
- end
40
+ calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
41
+ end
114
42
 
115
- def modified_impact_sub(isc_modified)
116
- if @modified_scope.selected_choice[:name] == 'Changed'
117
- 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
118
- else
119
- 6.42 * isc_modified
43
+ private
44
+
45
+ def init_properties
46
+ @properties.push(@confidentiality_requirement =
47
+ CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
48
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
49
+ { name: 'Medium', abbreviation: 'M', weight: 1.0 },
50
+ { name: 'High', abbreviation: 'H', weight: 1.5 },
51
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
52
+ @properties.push(@integrity_requirement =
53
+ CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
54
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
55
+ { name: 'Medium', abbreviation: 'M', weight: 1.0 },
56
+ { name: 'High', abbreviation: 'H', weight: 1.5 },
57
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
58
+
59
+ @properties.push(@availability_requirement =
60
+ CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
61
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
62
+ { name: 'Medium', abbreviation: 'M', weight: 1.0 },
63
+ { name: 'High', abbreviation: 'H', weight: 1.5 },
64
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
65
+ @properties.push(@modified_attack_vector =
66
+ CvssProperty.new(name: 'Modified Attack Vector', abbreviation: 'MAV', position: [11, 14],
67
+ choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
68
+ { name: 'Adjacent Network', abbreviation: 'A', weight: 0.62 },
69
+ { name: 'Local', abbreviation: 'L', weight: 0.55 },
70
+ { name: 'Physical', abbreviation: 'P', weight: 0.2 },
71
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
72
+ @properties.push(@modified_attack_complexity =
73
+ CvssProperty.new(name: 'Modified Attack Complexity', abbreviation: 'MAC', position: [12, 15],
74
+ choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
75
+ { name: 'High', abbreviation: 'H', weight: 0.44 },
76
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
77
+ @properties.push(@modified_privileges_required =
78
+ CvssProperty.new(name: 'Modified Privileges Required', abbreviation: 'MPR', position: [13, 16],
79
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
80
+ { name: 'Low', abbreviation: 'L', weight: 0.62 },
81
+ { name: 'High', abbreviation: 'H', weight: 0.27 },
82
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
83
+ @properties.push(@modified_user_interaction =
84
+ CvssProperty.new(name: 'Modified User Interaction', abbreviation: 'MUI', position: [14, 17],
85
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
86
+ { name: 'Required', abbreviation: 'R', weight: 0.62 },
87
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
88
+ @properties.push(@modified_scope =
89
+ CvssProperty.new(name: 'Modified Scope', abbreviation: 'MS', position: [15, 18],
90
+ choices: [{ name: 'Changed', abbreviation: 'C' },
91
+ { name: 'Unchanged', abbreviation: 'U' }]))
92
+ @properties.push(@modified_confidentiality =
93
+ CvssProperty.new(name: 'Modified Confidentiality', abbreviation: 'MC', position: [16, 19],
94
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
95
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
96
+ { name: 'High', abbreviation: 'H', weight: 0.56 },
97
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
98
+ @properties.push(@modified_integrity =
99
+ CvssProperty.new(name: 'Modified Integrity', abbreviation: 'MI', position: [17, 20],
100
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
101
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
102
+ { name: 'High', abbreviation: 'H', weight: 0.56 },
103
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
104
+ @properties.push(@modified_availability =
105
+ CvssProperty.new(name: 'Modified Availability', abbreviation: 'MA', position: [18, 21],
106
+ choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
107
+ { name: 'Low', abbreviation: 'L', weight: 0.22 },
108
+ { name: 'High', abbreviation: 'H', weight: 0.56 },
109
+ { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
120
110
  end
121
- end
122
111
 
123
- def isc_modified
124
- confidentiality_score = 1 - @modified_confidentiality.score * @confidentiality_requirement.score
125
- integrity_score = 1 - @modified_integrity.score * @integrity_requirement.score
126
- availability_score = 1 - @modified_availability.score * @availability_requirement.score
112
+ def modified_impact_sub(isc_modified)
113
+ if @modified_scope.selected_choice[:name] == 'Changed'
114
+ 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
115
+ else
116
+ 6.42 * isc_modified
117
+ end
118
+ end
127
119
 
128
- [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
129
- end
120
+ def isc_modified
121
+ confidentiality_score = 1 - @modified_confidentiality.score * @confidentiality_requirement.score
122
+ integrity_score = 1 - @modified_integrity.score * @integrity_requirement.score
123
+ availability_score = 1 - @modified_availability.score * @availability_requirement.score
130
124
 
131
- def modified_exploitability_sub(privilege_score)
132
- modified_exploitability_sub_score = 8.22 * @modified_attack_vector.score
133
- modified_exploitability_sub_score *= @modified_attack_complexity.score
134
- modified_exploitability_sub_score *= privilege_score
135
- modified_exploitability_sub_score *= @modified_user_interaction.score
136
- end
125
+ [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
126
+ end
137
127
 
138
- def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
139
- factor = @modified_scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
128
+ def modified_exploitability_sub(privilege_score)
129
+ 8.22 * @modified_attack_vector.score * @modified_attack_complexity.score *
130
+ privilege_score * @modified_user_interaction.score
131
+ end
140
132
 
141
- ([factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min.round_up(1) * temporal_score)
133
+ def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
134
+ factor = @modified_scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
142
135
 
136
+ Cvss3Helper.round_up(
137
+ [factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min
138
+ ) * temporal_score
139
+ end
143
140
  end
144
- end
141
+ end
data/lib/cvss_suite/cvss3/cvss3_temporal.rb CHANGED
@@ -14,44 +14,46 @@ require_relative '../cvss_metric'
14
14
  ##
15
15
  # This class represents a CVSS Temporal metric in version 3.
16
16
 
17
- class Cvss3Temporal < CvssMetric
18
-
19
- ##
20
- # Property of this metric
21
-
22
- attr_reader :exploit_code_maturity, :remediation_level, :report_confidence
23
-
24
- ##
25
- # Returns score of this metric
26
-
27
- def score
28
- return 1.0 unless valid?
29
- @exploit_code_maturity.score * @remediation_level.score * @report_confidence.score
30
- end
31
-
32
- private
33
-
34
- def init_properties
35
- @properties.push(@exploit_code_maturity =
36
- CvssProperty.new(name: 'Exploit Code Maturity', abbreviation: 'E', position: [8],
37
- choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
38
- { name: 'Unproven', abbreviation: 'U', weight: 0.91 },
39
- { name: 'Proof-of-Concept', abbreviation: 'P', weight: 0.94 },
40
- { name: 'Functional', abbreviation: 'F', weight: 0.97 },
41
- { name: 'High', abbreviation: 'H', weight: 1.0 }]))
42
- @properties.push(@remediation_level =
43
- CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [9],
44
- choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
45
- { name: 'Official Fix', abbreviation: 'O', weight: 0.95 },
46
- { name: 'Temporary Fix', abbreviation: 'T', weight: 0.96 },
47
- { name: 'Workaround', abbreviation: 'W', weight: 0.97 },
48
- { name: 'Unavailable', abbreviation: 'U', weight: 1.0 }]))
49
-
50
- @properties.push(@report_confidence =
51
- CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [10],
52
- choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
53
- { name: 'Unknown', abbreviation: 'U', weight: 0.92 },
54
- { name: 'Reasonable', abbreviation: 'R', weight: 0.96 },
55
- { name: 'Confirmed', abbreviation: 'C', weight: 1.0 }]))
17
+ module CvssSuite
18
+ class Cvss3Temporal < CvssMetric
19
+ ##
20
+ # Property of this metric
21
+
22
+ attr_reader :exploit_code_maturity, :remediation_level, :report_confidence
23
+
24
+ ##
25
+ # Returns score of this metric
26
+
27
+ def score
28
+ return 1.0 unless valid?
29
+
30
+ @exploit_code_maturity.score * @remediation_level.score * @report_confidence.score
31
+ end
32
+
33
+ private
34
+
35
+ def init_properties
36
+ @properties.push(@exploit_code_maturity =
37
+ CvssProperty.new(name: 'Exploit Code Maturity', abbreviation: 'E', position: [8],
38
+ choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
39
+ { name: 'Unproven', abbreviation: 'U', weight: 0.91 },
40
+ { name: 'Proof-of-Concept', abbreviation: 'P', weight: 0.94 },
41
+ { name: 'Functional', abbreviation: 'F', weight: 0.97 },
42
+ { name: 'High', abbreviation: 'H', weight: 1.0 }]))
43
+ @properties.push(@remediation_level =
44
+ CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [9],
45
+ choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
46
+ { name: 'Official Fix', abbreviation: 'O', weight: 0.95 },
47
+ { name: 'Temporary Fix', abbreviation: 'T', weight: 0.96 },
48
+ { name: 'Workaround', abbreviation: 'W', weight: 0.97 },
49
+ { name: 'Unavailable', abbreviation: 'U', weight: 1.0 }]))
50
+
51
+ @properties.push(@report_confidence =
52
+ CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [10],
53
+ choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
54
+ { name: 'Unknown', abbreviation: 'U', weight: 0.92 },
55
+ { name: 'Reasonable', abbreviation: 'R', weight: 0.96 },
56
+ { name: 'Confirmed', abbreviation: 'C', weight: 1.0 }]))
57
+ end
56
58
  end
57
- end
59
+ end