cvss-suite 1.2.2 → 2.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/rubocop.yml +21 -0
- data/.rubocop.yml +6 -33
- data/.rubocop_todo.yml +2 -67
- data/CHANGES.md +5 -6
- data/README.md +15 -9
- data/cvss_suite.gemspec +1 -1
- data/lib/cvss_suite.rb +2 -6
- data/lib/cvss_suite/cvss.rb +7 -14
- data/lib/cvss_suite/cvss2/cvss2.rb +2 -7
- data/lib/cvss_suite/cvss2/cvss2_base.rb +9 -12
- data/lib/cvss_suite/cvss2/cvss2_environmental.rb +10 -11
- data/lib/cvss_suite/cvss2/cvss2_temporal.rb +5 -8
- data/lib/cvss_suite/cvss3/cvss3.rb +3 -8
- data/lib/cvss_suite/cvss3/cvss3_base.rb +14 -16
- data/lib/cvss_suite/cvss3/cvss3_environmental.rb +24 -81
- data/lib/cvss_suite/cvss3/cvss3_temporal.rb +5 -8
- data/lib/cvss_suite/cvss31/cvss31.rb +3 -4
- data/lib/cvss_suite/cvss31/cvss31_base.rb +14 -15
- data/lib/cvss_suite/cvss31/cvss31_environmental.rb +24 -81
- data/lib/cvss_suite/cvss31/cvss31_temporal.rb +5 -8
- data/lib/cvss_suite/cvss_metric.rb +5 -9
- data/lib/cvss_suite/cvss_property.rb +18 -19
- data/lib/cvss_suite/helpers/cvss3_helper.rb +6 -7
- data/lib/cvss_suite/invalid_cvss.rb +2 -9
- data/lib/cvss_suite/version.rb +1 -1
- metadata +4 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 5917987479ecee6f2a020076b59751dda816e259d984a540bd1b6c0fb40b6422
|
4
|
+
data.tar.gz: 5225e8afd1e553709590bc2bb1a60955c76462d62bbfe825bf2a2081d4647163
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 6824cf5f7f04f2f8eb5ef5613e61fd86b275b36fd316c7f4d4d60af8f9422176b1485eefe24de482e9dc98c328291ed2a7bccafdec3f03d353fae505c43d988c
|
7
|
+
data.tar.gz: 2014e6368dea9deecd623d88a7f7b4d4c5367d1cb3a832ebdac3f6b47d5308b03e1129d157a11dad7e6ac93645ca971ad8dc4b8d85efdd83145f0f58883af6a4
|
@@ -0,0 +1,21 @@
|
|
1
|
+
name: Rubocop
|
2
|
+
|
3
|
+
on: [push,pull_request]
|
4
|
+
|
5
|
+
jobs:
|
6
|
+
build:
|
7
|
+
|
8
|
+
runs-on: ubuntu-latest
|
9
|
+
|
10
|
+
steps:
|
11
|
+
- uses: actions/checkout@v2
|
12
|
+
- name: Set up Ruby 2.7
|
13
|
+
uses: actions/setup-ruby@v1
|
14
|
+
with:
|
15
|
+
ruby-version: 2.7
|
16
|
+
- name: Build
|
17
|
+
run: |
|
18
|
+
gem install bundler -v "=> 1.10"
|
19
|
+
gem install rubocop
|
20
|
+
- name: Run tests
|
21
|
+
run: rubocop -F --fail-level C -f s
|
data/.rubocop.yml
CHANGED
@@ -1,40 +1,13 @@
|
|
1
1
|
inherit_from: .rubocop_todo.yml
|
2
2
|
|
3
|
+
AllCops:
|
4
|
+
TargetRubyVersion: 2.4
|
5
|
+
|
3
6
|
Metrics/LineLength:
|
4
7
|
Max: 120
|
5
|
-
Exclude:
|
6
|
-
- 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
|
7
|
-
- 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
|
8
|
-
|
9
|
-
Metrics/ClassLength:
|
10
|
-
Exclude:
|
11
|
-
- 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
|
12
|
-
- 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
|
13
|
-
|
14
|
-
Metrics/MethodLength:
|
15
|
-
Exclude:
|
16
|
-
- 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
|
17
|
-
- 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
|
18
|
-
|
19
|
-
Metrics/BlockLength:
|
20
|
-
Exclude:
|
21
|
-
- 'spec/cvss3/cvss3_spec.rb'
|
22
|
-
- 'spec/cvss31/cvss31_spec.rb'
|
23
|
-
|
24
|
-
Style/IfUnlessModifier:
|
25
|
-
Exclude:
|
26
|
-
- 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
|
27
|
-
- 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
|
28
|
-
|
29
|
-
Style/GuardClause:
|
30
|
-
Exclude:
|
31
|
-
- 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
|
32
|
-
- 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
|
33
|
-
|
34
|
-
Style/ConditionalAssignment:
|
35
|
-
Exclude:
|
36
|
-
- 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
|
37
|
-
- 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
|
38
8
|
|
39
9
|
Style/FrozenStringLiteralComment:
|
40
10
|
Enabled: false
|
11
|
+
|
12
|
+
Style/AsciiComments:
|
13
|
+
Enabled: false
|
data/.rubocop_todo.yml
CHANGED
@@ -1,3 +1,4 @@
|
|
1
|
+
# This configuration was generated by
|
1
2
|
# `rubocop --auto-gen-config`
|
2
3
|
# on 2020-05-05 17:47:10 +0200 using RuboCop version 0.82.0.
|
3
4
|
# The point is for the user to remove these configuration records
|
@@ -16,13 +17,6 @@ Lint/UselessAccessModifier:
|
|
16
17
|
Exclude:
|
17
18
|
- 'lib/cvss_suite.rb'
|
18
19
|
|
19
|
-
# Offense count: 3
|
20
|
-
Lint/UselessAssignment:
|
21
|
-
Exclude:
|
22
|
-
- 'lib/cvss_suite/cvss.rb'
|
23
|
-
- 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
|
24
|
-
- 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
|
25
|
-
|
26
20
|
# Offense count: 8
|
27
21
|
# Configuration parameters: IgnoredMethods.
|
28
22
|
Metrics/AbcSize:
|
@@ -32,12 +26,7 @@ Metrics/AbcSize:
|
|
32
26
|
# Configuration parameters: CountComments, ExcludedMethods.
|
33
27
|
# ExcludedMethods: refine
|
34
28
|
Metrics/BlockLength:
|
35
|
-
Max:
|
36
|
-
|
37
|
-
# Offense count: 2
|
38
|
-
# Configuration parameters: CountComments.
|
39
|
-
Metrics/ClassLength:
|
40
|
-
Max: 102
|
29
|
+
Max: 58
|
41
30
|
|
42
31
|
# Offense count: 2
|
43
32
|
# Configuration parameters: CountComments.
|
@@ -68,57 +57,3 @@ Metrics/PerceivedComplexity:
|
|
68
57
|
Naming/AccessorMethodName:
|
69
58
|
Exclude:
|
70
59
|
- 'lib/cvss_suite/cvss_property.rb'
|
71
|
-
|
72
|
-
# Offense count: 31
|
73
|
-
# Configuration parameters: AllowedChars.
|
74
|
-
Style/AsciiComments:
|
75
|
-
Enabled: false
|
76
|
-
|
77
|
-
# Offense count: 20
|
78
|
-
Style/Documentation:
|
79
|
-
Enabled: false
|
80
|
-
|
81
|
-
# Offense count: 2
|
82
|
-
# Configuration parameters: MinBodyLength.
|
83
|
-
Style/GuardClause:
|
84
|
-
Exclude:
|
85
|
-
- 'lib/cvss_suite/helpers/extensions.rb'
|
86
|
-
|
87
|
-
# Offense count: 1
|
88
|
-
# Cop supports --auto-correct.
|
89
|
-
Style/IfUnlessModifier:
|
90
|
-
Exclude:
|
91
|
-
- 'lib/cvss_suite.rb'
|
92
|
-
|
93
|
-
# Offense count: 2
|
94
|
-
# Cop supports --auto-correct.
|
95
|
-
# Configuration parameters: EnforcedStyle.
|
96
|
-
# SupportedStyles: literals, strict
|
97
|
-
Style/MutableConstant:
|
98
|
-
Exclude:
|
99
|
-
- 'lib/cvss_suite.rb'
|
100
|
-
- 'lib/cvss_suite/version.rb'
|
101
|
-
|
102
|
-
# Offense count: 8
|
103
|
-
# Cop supports --auto-correct.
|
104
|
-
# Configuration parameters: Strict.
|
105
|
-
Style/NumericLiterals:
|
106
|
-
MinDigits: 7
|
107
|
-
|
108
|
-
# Offense count: 3
|
109
|
-
# Cop supports --auto-correct.
|
110
|
-
# Configuration parameters: AutoCorrect, EnforcedStyle, IgnoredMethods.
|
111
|
-
# SupportedStyles: predicate, comparison
|
112
|
-
Style/NumericPredicate:
|
113
|
-
Exclude:
|
114
|
-
- 'spec/**/*'
|
115
|
-
- 'lib/cvss_suite/cvss2/cvss2_base.rb'
|
116
|
-
- 'lib/cvss_suite/helpers/extensions.rb'
|
117
|
-
|
118
|
-
# Offense count: 1
|
119
|
-
# Cop supports --auto-correct.
|
120
|
-
# Configuration parameters: ConvertCodeThatCanStartToReturnNil, AllowedMethods.
|
121
|
-
# AllowedMethods: present?, blank?, presence, try, try!
|
122
|
-
Style/SafeNavigation:
|
123
|
-
Exclude:
|
124
|
-
- 'lib/cvss_suite/cvss_metric.rb'
|
data/CHANGES.md
CHANGED
@@ -2,12 +2,11 @@
|
|
2
2
|
All notable changes to this project will be documented in this file.
|
3
3
|
This project adheres to [Semantic Versioning](http://semver.org/).
|
4
4
|
|
5
|
-
## [
|
5
|
+
## [2.0.0] - 2020-05-10
|
6
6
|
|
7
|
-
###
|
8
|
-
|
9
|
-
|
10
|
-
## [1.2.1] - 2020-05-10
|
7
|
+
### Breaking Changes
|
8
|
+
* Ruby >= 2.4 is now required
|
9
|
+
* Renamed choice/choices to value/values
|
11
10
|
|
12
11
|
### Improvements
|
13
12
|
* Added CvssSuite module to every class (thanks to @fwininger)
|
@@ -100,4 +99,4 @@ Tried to fix an error. It turned out to be a local problem. Due to this I increa
|
|
100
99
|
|
101
100
|
## [1.0.0] - 2016-04-15
|
102
101
|
### Initial release
|
103
|
-
First release of this gem.
|
102
|
+
First release of this gem.
|
data/README.md
CHANGED
@@ -1,11 +1,11 @@
|
|
1
1
|
# CvssSuite for Ruby
|
2
2
|
|
3
3
|
[![Gem Version](http://img.shields.io/gem/v/cvss-suite.svg)](https://rubygems.org/gems/cvss-suite)
|
4
|
-
[![Ruby Version](https://img.shields.io/badge/Ruby-2.
|
4
|
+
[![Ruby Version](https://img.shields.io/badge/Ruby-2.4-brightgreen.svg)](https://rubygems.org/gems/cvss-suite)
|
5
5
|
[![Cvss Support](https://img.shields.io/badge/CVSS-v2-brightgreen.svg)](https://www.first.org/cvss/v2/guide)
|
6
6
|
[![Cvss Support](https://img.shields.io/badge/CVSS-v3.0-brightgreen.svg)](https://www.first.org/cvss/v3.0/user-guide)
|
7
7
|
[![Cvss Support](https://img.shields.io/badge/CVSS-v3.1-brightgreen.svg)](https://www.first.org/cvss/v3.1/user-guide)
|
8
|
-
![RSpec](https://github.com/siemens/cvss-suite/workflows/RSpec/badge.svg)
|
8
|
+
[![RSpec](https://github.com/siemens/cvss-suite/workflows/RSpec/badge.svg)](https://github.com/siemens/cvss-suite/actions)
|
9
9
|
|
10
10
|
This Ruby gem helps you to process the vector of the [**Common Vulnerability Scoring System**](https://www.first.org/cvss/specification-document).
|
11
11
|
Besides calculating the Base, Temporal and Environmental Score, you are able to extract the selected option.
|
@@ -25,6 +25,10 @@ And then execute:
|
|
25
25
|
Or install it yourself as:
|
26
26
|
|
27
27
|
$ gem install cvss-suite
|
28
|
+
|
29
|
+
## Version 1.x
|
30
|
+
|
31
|
+
If your still using CvssSuite 1.x please refer to the [specific branch](https://github.com/siemens/cvss-suite/tree/1.x) for documentation and changelog.
|
28
32
|
|
29
33
|
## Usage
|
30
34
|
|
@@ -62,15 +66,15 @@ overall_score = cvss.overall_score # 3.2
|
|
62
66
|
access_vector = cvss.base.access_vector.name # 'Access Vector'
|
63
67
|
remediation_level = cvss.temporal.remediation_level.name # 'Remediation Level'
|
64
68
|
|
65
|
-
access_vector.
|
66
|
-
|
67
|
-
|
68
|
-
|
69
|
+
access_vector.values.each do |value|
|
70
|
+
value[:name] # 'Local', 'Adjacent Network', 'Network'
|
71
|
+
value[:abbreviation] # 'L', 'A', 'N'
|
72
|
+
value[:selected] # false, true, false
|
69
73
|
end
|
70
74
|
|
71
75
|
# Selected options
|
72
|
-
cvss.base.access_vector.
|
73
|
-
cvss.temporal.remediation_level.
|
76
|
+
cvss.base.access_vector.selected_value[:name] # Adjacent Network
|
77
|
+
cvss.temporal.remediation_level.selected_value[:name] # Temporary Fix
|
74
78
|
|
75
79
|
# Exceptions
|
76
80
|
|
@@ -100,11 +104,13 @@ Properties (Access Vector, Remediation Level, etc) do have a position attribute,
|
|
100
104
|
|
101
105
|
Currently it is not possible to leave an attribute blank instead of ND/X. If you don't have a value for an attribute, please use ND/X instead.
|
102
106
|
|
107
|
+
Because the documentation isn't clear on how to calculate the score if Modified Scope (CVSS 3.0 Environmental) is not defined, Modified Scope has to have a valid value (S/U).
|
108
|
+
|
103
109
|
There is a possibility of implementations generating different scores (+/- 0,1) due to small floating-point inaccuracies. This can happen due to differences in floating point arithmetic between different languages and hardware platforms.
|
104
110
|
|
105
111
|
## Changelog
|
106
112
|
|
107
|
-
[Click here to see all changes.](https://github.com/siemens/cvss-suite/blob/
|
113
|
+
[Click here to see all changes.](https://github.com/siemens/cvss-suite/blob/master/CHANGES.md)
|
108
114
|
|
109
115
|
## Contributing
|
110
116
|
|
data/cvss_suite.gemspec
CHANGED
@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
|
|
26
26
|
Besides calculating the Base, Temporal and Environmental Score, you are able to extract the selected option.'
|
27
27
|
spec.homepage = 'https://siemens.github.io/cvss-suite/'
|
28
28
|
|
29
|
-
spec.required_ruby_version = '>= 2.
|
29
|
+
spec.required_ruby_version = '>= 2.4.0'
|
30
30
|
spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
31
31
|
spec.bindir = 'exe'
|
32
32
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
data/lib/cvss_suite.rb
CHANGED
@@ -17,17 +17,15 @@ require 'cvss_suite/invalid_cvss'
|
|
17
17
|
|
18
18
|
##
|
19
19
|
# Module of this gem.
|
20
|
-
|
21
20
|
module CvssSuite
|
22
21
|
CVSS_VECTOR_BEGINNINGS = [
|
23
22
|
{ string: 'AV:', version: 2 },
|
24
23
|
{ string: 'CVSS:3.0/', version: 3.0 },
|
25
24
|
{ string: 'CVSS:3.1/', version: 3.1 }
|
26
|
-
]
|
25
|
+
].freeze
|
27
26
|
|
28
27
|
##
|
29
28
|
# Returns a CVSS class by a +vector+.
|
30
|
-
|
31
29
|
def self.new(vector)
|
32
30
|
return InvalidCvss.new unless vector.is_a? String
|
33
31
|
|
@@ -48,9 +46,7 @@ module CvssSuite
|
|
48
46
|
|
49
47
|
def self.version
|
50
48
|
CVSS_VECTOR_BEGINNINGS.each do |beginning|
|
51
|
-
if @vector_string.start_with? beginning[:string]
|
52
|
-
return beginning[:version]
|
53
|
-
end
|
49
|
+
return beginning[:version] if @vector_string.start_with? beginning[:string]
|
54
50
|
end
|
55
51
|
end
|
56
52
|
end
|
data/lib/cvss_suite/cvss.rb
CHANGED
@@ -8,26 +8,22 @@
|
|
8
8
|
# This work is licensed under the terms of the MIT license.
|
9
9
|
# See the LICENSE.md file in the top-level directory.
|
10
10
|
|
11
|
-
##
|
12
|
-
# This class represents any CVSS vector. Do not instantiate this class!
|
13
|
-
|
14
11
|
module CvssSuite
|
12
|
+
##
|
13
|
+
# This class represents any CVSS vector. Do not instantiate this class!
|
15
14
|
class Cvss
|
16
15
|
##
|
17
16
|
# Metric of a CVSS vector.
|
18
|
-
|
19
17
|
attr_reader :base, :temporal, :environmental
|
20
18
|
|
21
19
|
##
|
22
20
|
# Returns the vector itself.
|
23
|
-
|
24
21
|
attr_reader :vector
|
25
22
|
|
26
23
|
##
|
27
24
|
# Creates a new CVSS vector by a +vector+.
|
28
25
|
#
|
29
26
|
# Raises an exception if it is called on Cvss class.
|
30
|
-
|
31
27
|
def initialize(vector)
|
32
28
|
raise CvssSuite::Errors::InvalidParentClass, 'Do not instantiate this class!' if self.class == Cvss
|
33
29
|
|
@@ -39,7 +35,6 @@ module CvssSuite
|
|
39
35
|
|
40
36
|
##
|
41
37
|
# Returns if CVSS vector is valid.
|
42
|
-
|
43
38
|
def valid?
|
44
39
|
if @amount_of_properties == required_amount_of_properties
|
45
40
|
base = @base.valid?
|
@@ -54,7 +49,6 @@ module CvssSuite
|
|
54
49
|
|
55
50
|
##
|
56
51
|
# Returns the severity of the CVSS vector.
|
57
|
-
|
58
52
|
def severity
|
59
53
|
check_validity
|
60
54
|
|
@@ -62,13 +56,13 @@ module CvssSuite
|
|
62
56
|
|
63
57
|
if score == 0.0
|
64
58
|
'None'
|
65
|
-
elsif (0.1..3.9).
|
59
|
+
elsif (0.1..3.9).cover? score
|
66
60
|
'Low'
|
67
|
-
elsif (4.0..6.9).
|
61
|
+
elsif (4.0..6.9).cover? score
|
68
62
|
'Medium'
|
69
|
-
elsif (7.0..8.9).
|
63
|
+
elsif (7.0..8.9).cover? score
|
70
64
|
'High'
|
71
|
-
elsif (9.0..10.0).
|
65
|
+
elsif (9.0..10.0).cover? score
|
72
66
|
'Critical'
|
73
67
|
else
|
74
68
|
'None'
|
@@ -77,7 +71,6 @@ module CvssSuite
|
|
77
71
|
|
78
72
|
##
|
79
73
|
# Returns the Overall Score of the CVSS vector.
|
80
|
-
|
81
74
|
def overall_score
|
82
75
|
check_validity
|
83
76
|
return temporal_score if @temporal.valid? && !@environmental.valid?
|
@@ -115,7 +108,7 @@ module CvssSuite
|
|
115
108
|
total = @base.count if @base.valid?
|
116
109
|
total += @temporal.count if @temporal.valid?
|
117
110
|
total += @environmental.count if @environmental.valid?
|
118
|
-
total
|
111
|
+
total || 0
|
119
112
|
end
|
120
113
|
end
|
121
114
|
end
|
@@ -13,21 +13,18 @@ require_relative 'cvss2_base'
|
|
13
13
|
require_relative 'cvss2_temporal'
|
14
14
|
require_relative 'cvss2_environmental'
|
15
15
|
|
16
|
-
##
|
17
|
-
# This class represents a CVSS vector in version 2.
|
18
|
-
|
19
16
|
module CvssSuite
|
17
|
+
##
|
18
|
+
# This class represents a CVSS vector in version 2.
|
20
19
|
class Cvss2 < Cvss
|
21
20
|
##
|
22
21
|
# Returns the Version of the CVSS vector.
|
23
|
-
|
24
22
|
def version
|
25
23
|
2
|
26
24
|
end
|
27
25
|
|
28
26
|
##
|
29
27
|
# Returns the Base Score of the CVSS vector.
|
30
|
-
|
31
28
|
def base_score
|
32
29
|
check_validity
|
33
30
|
@base.score.round(1)
|
@@ -35,14 +32,12 @@ module CvssSuite
|
|
35
32
|
|
36
33
|
##
|
37
34
|
# Returns the Temporal Score of the CVSS vector.
|
38
|
-
|
39
35
|
def temporal_score
|
40
36
|
(base_score * @temporal.score).round(1)
|
41
37
|
end
|
42
38
|
|
43
39
|
##
|
44
40
|
# Returns the Environmental Score of the CVSS vector.
|
45
|
-
|
46
41
|
def environmental_score
|
47
42
|
return temporal_score unless @environmental.valid?
|
48
43
|
|
@@ -11,14 +11,12 @@
|
|
11
11
|
require_relative '../cvss_property'
|
12
12
|
require_relative '../cvss_metric'
|
13
13
|
|
14
|
-
##
|
15
|
-
# This class represents a CVSS Base metric in version 2.
|
16
|
-
|
17
14
|
module CvssSuite
|
15
|
+
##
|
16
|
+
# This class represents a CVSS Base metric in version 2.
|
18
17
|
class Cvss2Base < CvssMetric
|
19
18
|
##
|
20
19
|
# Property of this metric
|
21
|
-
|
22
20
|
attr_reader :access_vector, :access_complexity, :authentication,
|
23
21
|
:confidentiality_impact, :integrity_impact, :availability_impact
|
24
22
|
|
@@ -27,13 +25,12 @@ module CvssSuite
|
|
27
25
|
# See CVSS documentation for further information https://www.first.org/cvss/v2/guide#i3.2.1 .
|
28
26
|
#
|
29
27
|
# Takes +Security+ +Requirement+ +Impacts+ for calculating environmental score.
|
30
|
-
|
31
28
|
def score(sr_cr_score = 1, sr_ir_score = 1, sr_ar_score = 1)
|
32
29
|
impact = calc_impact(sr_cr_score, sr_ir_score, sr_ar_score)
|
33
30
|
|
34
31
|
exploitability = calc_exploitability
|
35
32
|
|
36
|
-
additional_impact = (impact
|
33
|
+
additional_impact = (impact.zero? ? 0 : 1.176)
|
37
34
|
|
38
35
|
((0.6 * impact) + (0.4 * exploitability) - 1.5) * additional_impact
|
39
36
|
end
|
@@ -43,32 +40,32 @@ module CvssSuite
|
|
43
40
|
def init_properties
|
44
41
|
@properties.push(@access_vector =
|
45
42
|
CvssProperty.new(name: 'Access Vector', abbreviation: 'AV', position: [0],
|
46
|
-
|
43
|
+
values: [{ name: 'Network', abbreviation: 'N', weight: 1.0 },
|
47
44
|
{ name: 'Adjacent Network', abbreviation: 'A', weight: 0.646 },
|
48
45
|
{ name: 'Local', abbreviation: 'L', weight: 0.395 }]))
|
49
46
|
@properties.push(@access_complexity =
|
50
47
|
CvssProperty.new(name: 'Access Complexity', abbreviation: 'AC', position: [1],
|
51
|
-
|
48
|
+
values: [{ name: 'Low', abbreviation: 'L', weight: 0.71 },
|
52
49
|
{ name: 'Medium', abbreviation: 'M', weight: 0.61 },
|
53
50
|
{ name: 'High', abbreviation: 'H', weight: 0.35 }]))
|
54
51
|
@properties.push(@authentication =
|
55
52
|
CvssProperty.new(name: 'Authentication', abbreviation: 'Au', position: [2],
|
56
|
-
|
53
|
+
values: [{ name: 'None', abbreviation: 'N', weight: 0.704 },
|
57
54
|
{ name: 'Single', abbreviation: 'S', weight: 0.56 },
|
58
55
|
{ name: 'Multiple', abbreviation: 'M', weight: 0.45 }]))
|
59
56
|
@properties.push(@confidentiality_impact =
|
60
57
|
CvssProperty.new(name: 'Confidentiality Impact', abbreviation: 'C', position: [3],
|
61
|
-
|
58
|
+
values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
|
62
59
|
{ name: 'Partial', abbreviation: 'P', weight: 0.275 },
|
63
60
|
{ name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
|
64
61
|
@properties.push(@integrity_impact =
|
65
62
|
CvssProperty.new(name: 'Integrity Impact', abbreviation: 'I', position: [4],
|
66
|
-
|
63
|
+
values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
|
67
64
|
{ name: 'Partial', abbreviation: 'P', weight: 0.275 },
|
68
65
|
{ name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
|
69
66
|
@properties.push(@availability_impact =
|
70
67
|
CvssProperty.new(name: 'Availability Impact', abbreviation: 'A', position: [5],
|
71
|
-
|
68
|
+
values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
|
72
69
|
{ name: 'Partial', abbreviation: 'P', weight: 0.275 },
|
73
70
|
{ name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
|
74
71
|
end
|