cvss-suite 1.2.0 → 2.0.2

data/lib/cvss_suite/cvss2/cvss2.rb

@@ -8,45 +8,67 @@
 # This work is licensed under the terms of the MIT license.
 # See the LICENSE.md file in the top-level directory.
 
-require_relative '../../../lib/cvss_suite/cvss'
+require_relative '../cvss'
 require_relative 'cvss2_base'
 require_relative 'cvss2_temporal'
 require_relative 'cvss2_environmental'
 
-##
-# This class represents a CVSS vector in version 2.
+module CvssSuite
+  ##
+  # This class represents a CVSS vector in version 2.
+  class Cvss2 < Cvss
+    ##
+    # Returns the Version of the CVSS vector.
+    def version
+      2
+    end
 
-class Cvss2 < Cvss
+    # Returns the severity of the CVSSv2 vector.
+    # https://nvd.nist.gov/vuln-metrics/cvss
+    def severity
+      check_validity
 
-  ##
-  # Returns the Base Score of the CVSS vector.
+      score = overall_score
 
-  def base_score
-    check_validity
-    @base.score.round(1)
-  end
+      case score
+      when 0.0..3.9
+        'Low'
+      when 4.0..6.9
+        'Medium'
+      when 7.0..10.0
+        'High'
+      else
+        'None'
+      end
+    end
 
-  ##
-  # Returns the Temporal Score of the CVSS vector.
+    ##
+    # Returns the Base Score of the CVSS vector.
+    def base_score
+      check_validity
+      @base.score.round(1)
+    end
 
-  def temporal_score
-    (base_score * @temporal.score).round(1)
-  end
+    ##
+    # Returns the Temporal Score of the CVSS vector.
+    def temporal_score
+      (base_score * @temporal.score).round(1)
+    end
 
-  ##
-  # Returns the Environmental Score of the CVSS vector.
+    ##
+    # Returns the Environmental Score of the CVSS vector.
+    def environmental_score
+      return temporal_score unless @environmental.valid?
 
-  def environmental_score
-    return temporal_score unless @environmental.valid?
-    (@environmental.score @base, @temporal.score).round(1)
-  end
+      (@environmental.score @base, @temporal.score).round(1)
+    end
 
-  private
+    private
 
-  def init_metrics
-    @base = Cvss2Base.new(@properties)
-    @temporal = Cvss2Temporal.new(@properties)
-    @environmental = Cvss2Environmental.new(@properties)
+    def init_metrics
+      @base = Cvss2Base.new(@properties)
+      @temporal = Cvss2Temporal.new(@properties)
+      @environmental = Cvss2Environmental.new(@properties)
+    end
   end
-
-end
+end

data/lib/cvss_suite/cvss2/cvss2_base.rb

@@ -11,81 +11,75 @@
 require_relative '../cvss_property'
 require_relative '../cvss_metric'
 
-##
-# This class represents a CVSS Base metric in version 2.
-
-class Cvss2Base < CvssMetric
-
-  ##
-  # Property of this metric
-
-  attr_reader :access_vector, :access_complexity, :authentication,
-              :confidentiality_impact, :integrity_impact, :availability_impact
-
+module CvssSuite
   ##
-  # Returns the base score of the CVSS vector. The calculation is based on formula version 2.10 .
-  # See CVSS documentation for further information https://www.first.org/cvss/v2/guide#i3.2.1 .
-  #
-  # Takes +Security+ +Requirement+ +Impacts+ for calculating environmental score.
-
-  def score(sr_cr_score = 1, sr_ir_score = 1, sr_ar_score = 1)
-
-    impact = calc_impact sr_cr_score, sr_ir_score, sr_ar_score
-
-    exploitability = calc_exploitability
-
-    additional_impact = (impact == 0 ? 0 : 1.176)
-
-    ((0.6 * impact) + (0.4 * exploitability) - 1.5) * additional_impact
-
+  # This class represents a CVSS Base metric in version 2.
+  class Cvss2Base < CvssMetric
+    ##
+    # Property of this metric
+    attr_reader :access_vector, :access_complexity, :authentication,
+                :confidentiality_impact, :integrity_impact, :availability_impact
+
+    ##
+    # Returns the base score of the CVSS vector. The calculation is based on formula version 2.10 .
+    # See CVSS documentation for further information https://www.first.org/cvss/v2/guide#i3.2.1 .
+    #
+    # Takes +Security+ +Requirement+ +Impacts+ for calculating environmental score.
+    def score(sr_cr_score = 1, sr_ir_score = 1, sr_ar_score = 1)
+      impact = calc_impact(sr_cr_score, sr_ir_score, sr_ar_score)
+
+      exploitability = calc_exploitability
+
+      additional_impact = (impact.zero? ? 0 : 1.176)
+
+      ((0.6 * impact) + (0.4 * exploitability) - 1.5) * additional_impact
+    end
+
+    private
+
+    def init_properties
+      @properties.push(@access_vector =
+                         CvssProperty.new(name: 'Access Vector', abbreviation: 'AV', position: [0],
+                                          values: [{ name: 'Network', abbreviation: 'N', weight: 1.0 },
+                                                   { name: 'Adjacent Network', abbreviation: 'A', weight: 0.646 },
+                                                   { name: 'Local', abbreviation: 'L', weight: 0.395 }]))
+      @properties.push(@access_complexity =
+                         CvssProperty.new(name: 'Access Complexity', abbreviation: 'AC', position: [1],
+                                          values: [{ name: 'Low', abbreviation: 'L', weight: 0.71 },
+                                                   { name: 'Medium', abbreviation: 'M', weight: 0.61 },
+                                                   { name: 'High', abbreviation: 'H', weight: 0.35 }]))
+      @properties.push(@authentication =
+                         CvssProperty.new(name: 'Authentication', abbreviation: 'Au', position: [2],
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0.704 },
+                                                   { name: 'Single', abbreviation: 'S', weight: 0.56 },
+                                                   { name: 'Multiple', abbreviation: 'M', weight: 0.45 }]))
+      @properties.push(@confidentiality_impact =
+                         CvssProperty.new(name: 'Confidentiality Impact', abbreviation: 'C', position: [3],
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                   { name: 'Partial', abbreviation: 'P', weight: 0.275 },
+                                                   { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
+      @properties.push(@integrity_impact =
+                         CvssProperty.new(name: 'Integrity Impact', abbreviation: 'I', position: [4],
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                   { name: 'Partial', abbreviation: 'P', weight: 0.275 },
+                                                   { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
+      @properties.push(@availability_impact =
+                         CvssProperty.new(name: 'Availability Impact', abbreviation: 'A', position: [5],
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                   { name: 'Partial', abbreviation: 'P', weight: 0.275 },
+                                                   { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
+    end
+
+    def calc_impact(sr_cr_score, sr_ir_score, sr_ar_score)
+      confidentiality_score = 1 - @confidentiality_impact.score * sr_cr_score
+      integrity_score = 1 - @integrity_impact.score * sr_ir_score
+      availability_score = 1 - @availability_impact.score * sr_ar_score
+
+      [10, 10.41 * (1 - confidentiality_score * integrity_score * availability_score)].min
+    end
+
+    def calc_exploitability
+      20 * @access_vector.score * @access_complexity.score * @authentication.score
+    end
   end
-
-  private
-
-  def init_properties
-    @properties.push(@access_vector =
-                      CvssProperty.new(name: 'Access Vector', abbreviation: 'AV', position: [0],
-                                       choices: [{ name: 'Network', abbreviation: 'N', weight: 1.0 },
-                                                 { name: 'Adjacent Network', abbreviation: 'A', weight: 0.646 },
-                                                 { name: 'Local', abbreviation: 'L', weight: 0.395 }]))
-    @properties.push(@access_complexity =
-                      CvssProperty.new(name: 'Access Complexity', abbreviation: 'AC', position: [1],
-                                       choices: [{ name: 'Low', abbreviation: 'L', weight: 0.71 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 0.61 },
-                                                 { name: 'High', abbreviation: 'H', weight: 0.35 }]))
-    @properties.push(@authentication =
-                      CvssProperty.new(name: 'Authentication', abbreviation: 'Au', position: [2],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.704 },
-                                                 { name: 'Single', abbreviation: 'S', weight: 0.56 },
-                                                 { name: 'Multiple', abbreviation: 'M', weight: 0.45 }]))
-    @properties.push(@confidentiality_impact =
-                      CvssProperty.new(name: 'Confidentiality Impact', abbreviation: 'C', position: [3],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Partial', abbreviation: 'P', weight: 0.275 },
-                                                 { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
-    @properties.push(@integrity_impact =
-                      CvssProperty.new(name: 'Integrity Impact', abbreviation: 'I', position: [4],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Partial', abbreviation: 'P', weight: 0.275 },
-                                                 { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
-    @properties.push(@availability_impact =
-                      CvssProperty.new(name: 'Availability Impact', abbreviation: 'A', position: [5],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0},
-                                                 { name: 'Partial', abbreviation: 'P', weight: 0.275},
-                                                 { name: 'Complete', abbreviation: 'C', weight: 0.66}]))
-  end
-
-  def calc_impact(sr_cr_score, sr_ir_score, sr_ar_score)
-    confidentiality_score = 1 - @confidentiality_impact.score * sr_cr_score
-    integrity_score = 1 - @integrity_impact.score * sr_ir_score
-    availability_score = 1 - @availability_impact.score * sr_ar_score
-
-    [10, 10.41 * (1-confidentiality_score*integrity_score*availability_score)].min
-  end
-
-  def calc_exploitability
-    20 * @access_vector.score * @access_complexity.score * @authentication.score
-  end
-
 end
-

data/lib/cvss_suite/cvss2/cvss2_environmental.rb

@@ -11,64 +11,62 @@
 require_relative '../cvss_property'
 require_relative '../cvss_metric'
 
-##
-# This class represents a CVSS Environmental metric in version 2.
-
-class Cvss2Environmental < CvssMetric
-
-  ##
-  # Property of this metric
-
-  attr_reader :collateral_damage_potential, :target_distribution, :security_requirements_cr,
-              :security_requirements_ir, :security_requirements_ar
-
+module CvssSuite
   ##
-  # Returns score of this metric
-
-  def score(base, temporal_score)
-    base_score = (base.score @security_requirements_cr.score, @security_requirements_ir.score, @security_requirements_ar.score).round(1)
+  # This class represents a CVSS Environmental metric in version 2.
+  class Cvss2Environmental < CvssMetric
+    ##
+    # Property of this metric
+    attr_reader :collateral_damage_potential, :target_distribution, :security_requirements_cr,
+                :security_requirements_ir, :security_requirements_ar
 
-    adjusted_temporal = (base_score * temporal_score).round(1)
-    (adjusted_temporal + (10 - adjusted_temporal) * @collateral_damage_potential.score) * @target_distribution.score
+    ##
+    # Returns score of this metric
+    def score(base, temporal_score)
+      base_score = base.score(@security_requirements_cr.score,
+                              @security_requirements_ir.score,
+                              @security_requirements_ar.score).round(1)
 
-  end
+      adjusted_temporal = (base_score * temporal_score).round(1)
+      (adjusted_temporal + (10 - adjusted_temporal) * @collateral_damage_potential.score) * @target_distribution.score
+    end
 
-  private
+    private
 
-  def init_properties
-    @properties.push(@collateral_damage_potential =
-                      CvssProperty.new(name: 'Collateral Damage Potential', abbreviation: 'CDP', position: [6, 9],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Low', abbreviation: 'L', weight: 0.1 },
-                                                 { name: 'Low-Medium', abbreviation: 'LM', weight: 0.3 },
-                                                 { name: 'Medium-High', abbreviation: 'MH', weight: 0.4 },
-                                                 { name: 'High', abbreviation: 'H', weight: 0.5 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 0.0 }]))
-    @properties.push(@target_distribution =
-                      CvssProperty.new(name: 'Target Distribution', abbreviation: 'TD', position: [7, 10],
-                                       choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
-                                                 { name: 'Low', abbreviation: 'L', weight: 0.25 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 0.75 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1.0 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
-    @properties.push(@security_requirements_cr =
-                      CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
-                                       choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 1.0 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1.51 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
-    @properties.push(@security_requirements_ir =
-                      CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
-                                       choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 1.0 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1.51 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
-    @properties.push(@security_requirements_ar =
-                      CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
-                                       choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
-                                                 { name: 'Medium', abbreviation: 'M', weight: 1.0 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1.51 },
-                                                 { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+    def init_properties
+      @properties.push(@collateral_damage_potential =
+                         CvssProperty.new(name: 'Collateral Damage Potential', abbreviation: 'CDP', position: [6, 9],
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                   { name: 'Low', abbreviation: 'L', weight: 0.1 },
+                                                   { name: 'Low-Medium', abbreviation: 'LM', weight: 0.3 },
+                                                   { name: 'Medium-High', abbreviation: 'MH', weight: 0.4 },
+                                                   { name: 'High', abbreviation: 'H', weight: 0.5 },
+                                                   { name: 'Not Defined', abbreviation: 'ND', weight: 0.0 }]))
+      @properties.push(@target_distribution =
+                         CvssProperty.new(name: 'Target Distribution', abbreviation: 'TD', position: [7, 10],
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
+                                                   { name: 'Low', abbreviation: 'L', weight: 0.25 },
+                                                   { name: 'Medium', abbreviation: 'M', weight: 0.75 },
+                                                   { name: 'High', abbreviation: 'H', weight: 1.0 },
+                                                   { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+      @properties.push(@security_requirements_cr =
+                         CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
+                                          values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                   { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                   { name: 'High', abbreviation: 'H', weight: 1.51 },
+                                                   { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+      @properties.push(@security_requirements_ir =
+                         CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
+                                          values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                   { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                   { name: 'High', abbreviation: 'H', weight: 1.51 },
+                                                   { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+      @properties.push(@security_requirements_ar =
+                         CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
+                                          values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                                   { name: 'Medium', abbreviation: 'M', weight: 1.0 },
+                                                   { name: 'High', abbreviation: 'H', weight: 1.51 },
+                                                   { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
+    end
   end
 end
-

data/lib/cvss_suite/cvss2/cvss2_temporal.rb

@@ -11,47 +11,46 @@
 require_relative '../cvss_property'
 require_relative '../cvss_metric'
 
-##
-# This class represents a CVSS Temporal metric in version 2.
-
-class Cvss2Temporal < CvssMetric
-
-  ##
-  # Property of this metric
-
-  attr_reader :exploitability, :remediation_level, :report_confidence
-
+module CvssSuite
   ##
-  # Returns score of this metric
-
-  def score
-    return 1 unless valid?
-    @exploitability.score * @remediation_level.score * @report_confidence.score
-  end
-
-  private
-
-  def init_properties
-    @properties.push(@exploitability =
-                      CvssProperty.new(name: 'Exploitability', abbreviation: 'E', position: [6],
-                                       choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
-                                                 { name: 'Unproven', abbreviation: 'U', weight: 0.85 },
-                                                 { name: 'Proof-of-Concept', abbreviation: 'POC', weight: 0.9 },
-                                                 { name: 'Functional', abbreviation: 'F', weight: 0.95 },
-                                                 { name: 'High', abbreviation: 'H', weight: 1 }]))
-    @properties.push(@remediation_level =
-                      CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [7],
-                                       choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
-                                                 { name: 'Official Fix', abbreviation: 'OF', weight: 0.87 },
-                                                 { name: 'Temporary Fix', abbreviation: 'TF', weight: 0.9 },
-                                                 { name: 'Workaround', abbreviation: 'W', weight: 0.95 },
-                                                 { name: 'Unavailable', abbreviation: 'U', weight: 1 }]))
-
-    @properties.push(@report_confidence =
-                      CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [8],
-                                       choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
-                                                 { name: 'Unconfirmed', abbreviation: 'UC', weight: 0.9 },
-                                                 { name: 'Uncorroborated', abbreviation: 'UR', weight: 0.95 },
-                                                 { name: 'Confirmed', abbreviation: 'C', weight: 1 }]))
+  # This class represents a CVSS Temporal metric in version 2.
+  class Cvss2Temporal < CvssMetric
+    ##
+    # Property of this metric
+    attr_reader :exploitability, :remediation_level, :report_confidence
+
+    ##
+    # Returns score of this metric
+    def score
+      return 1 unless valid?
+
+      @exploitability.score * @remediation_level.score * @report_confidence.score
+    end
+
+    private
+
+    def init_properties
+      @properties.push(@exploitability =
+                         CvssProperty.new(name: 'Exploitability', abbreviation: 'E', position: [6],
+                                          values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
+                                                   { name: 'Unproven', abbreviation: 'U', weight: 0.85 },
+                                                   { name: 'Proof-of-Concept', abbreviation: 'POC', weight: 0.9 },
+                                                   { name: 'Functional', abbreviation: 'F', weight: 0.95 },
+                                                   { name: 'High', abbreviation: 'H', weight: 1 }]))
+      @properties.push(@remediation_level =
+                         CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [7],
+                                          values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
+                                                   { name: 'Official Fix', abbreviation: 'OF', weight: 0.87 },
+                                                   { name: 'Temporary Fix', abbreviation: 'TF', weight: 0.9 },
+                                                   { name: 'Workaround', abbreviation: 'W', weight: 0.95 },
+                                                   { name: 'Unavailable', abbreviation: 'U', weight: 1 }]))
+
+      @properties.push(@report_confidence =
+                         CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [8],
+                                          values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
+                                                   { name: 'Unconfirmed', abbreviation: 'UC', weight: 0.9 },
+                                                   { name: 'Uncorroborated', abbreviation: 'UR', weight: 0.95 },
+                                                   { name: 'Confirmed', abbreviation: 'C', weight: 1 }]))
+    end
   end
 end