cvss-suite 1.2.2 → 2.0.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (27) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/rubocop.yml +21 -0
  3. data/.rubocop.yml +6 -33
  4. data/.rubocop_todo.yml +2 -67
  5. data/CHANGES.md +5 -6
  6. data/README.md +15 -9
  7. data/cvss_suite.gemspec +1 -1
  8. data/lib/cvss_suite.rb +2 -6
  9. data/lib/cvss_suite/cvss.rb +7 -14
  10. data/lib/cvss_suite/cvss2/cvss2.rb +2 -7
  11. data/lib/cvss_suite/cvss2/cvss2_base.rb +9 -12
  12. data/lib/cvss_suite/cvss2/cvss2_environmental.rb +10 -11
  13. data/lib/cvss_suite/cvss2/cvss2_temporal.rb +5 -8
  14. data/lib/cvss_suite/cvss3/cvss3.rb +3 -8
  15. data/lib/cvss_suite/cvss3/cvss3_base.rb +14 -16
  16. data/lib/cvss_suite/cvss3/cvss3_environmental.rb +24 -81
  17. data/lib/cvss_suite/cvss3/cvss3_temporal.rb +5 -8
  18. data/lib/cvss_suite/cvss31/cvss31.rb +3 -4
  19. data/lib/cvss_suite/cvss31/cvss31_base.rb +14 -15
  20. data/lib/cvss_suite/cvss31/cvss31_environmental.rb +24 -81
  21. data/lib/cvss_suite/cvss31/cvss31_temporal.rb +5 -8
  22. data/lib/cvss_suite/cvss_metric.rb +5 -9
  23. data/lib/cvss_suite/cvss_property.rb +18 -19
  24. data/lib/cvss_suite/helpers/cvss3_helper.rb +6 -7
  25. data/lib/cvss_suite/invalid_cvss.rb +2 -9
  26. data/lib/cvss_suite/version.rb +1 -1
  27. metadata +4 -3
data/lib/cvss_suite/cvss2/cvss2_environmental.rb CHANGED
@@ -11,22 +11,21 @@
11
11
  require_relative '../cvss_property'
12
12
  require_relative '../cvss_metric'
13
13
 
14
- ##
15
- # This class represents a CVSS Environmental metric in version 2.
16
-
17
14
  module CvssSuite
15
+ ##
16
+ # This class represents a CVSS Environmental metric in version 2.
18
17
  class Cvss2Environmental < CvssMetric
19
18
  ##
20
19
  # Property of this metric
21
-
22
20
  attr_reader :collateral_damage_potential, :target_distribution, :security_requirements_cr,
23
21
  :security_requirements_ir, :security_requirements_ar
24
22
 
25
23
  ##
26
24
  # Returns score of this metric
27
-
28
25
  def score(base, temporal_score)
29
- base_score = (base.score @security_requirements_cr.score, @security_requirements_ir.score, @security_requirements_ar.score).round(1)
26
+ base_score = base.score(@security_requirements_cr.score,
27
+ @security_requirements_ir.score,
28
+ @security_requirements_ar.score).round(1)
30
29
 
31
30
  adjusted_temporal = (base_score * temporal_score).round(1)
32
31
  (adjusted_temporal + (10 - adjusted_temporal) * @collateral_damage_potential.score) * @target_distribution.score
@@ -37,7 +36,7 @@ module CvssSuite
37
36
  def init_properties
38
37
  @properties.push(@collateral_damage_potential =
39
38
  CvssProperty.new(name: 'Collateral Damage Potential', abbreviation: 'CDP', position: [6, 9],
40
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
39
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
41
40
  { name: 'Low', abbreviation: 'L', weight: 0.1 },
42
41
  { name: 'Low-Medium', abbreviation: 'LM', weight: 0.3 },
43
42
  { name: 'Medium-High', abbreviation: 'MH', weight: 0.4 },
@@ -45,26 +44,26 @@ module CvssSuite
45
44
  { name: 'Not Defined', abbreviation: 'ND', weight: 0.0 }]))
46
45
  @properties.push(@target_distribution =
47
46
  CvssProperty.new(name: 'Target Distribution', abbreviation: 'TD', position: [7, 10],
48
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
47
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
49
48
  { name: 'Low', abbreviation: 'L', weight: 0.25 },
50
49
  { name: 'Medium', abbreviation: 'M', weight: 0.75 },
51
50
  { name: 'High', abbreviation: 'H', weight: 1.0 },
52
51
  { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
53
52
  @properties.push(@security_requirements_cr =
54
53
  CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
55
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
54
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
56
55
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
57
56
  { name: 'High', abbreviation: 'H', weight: 1.51 },
58
57
  { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
59
58
  @properties.push(@security_requirements_ir =
60
59
  CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
61
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
60
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
62
61
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
63
62
  { name: 'High', abbreviation: 'H', weight: 1.51 },
64
63
  { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
65
64
  @properties.push(@security_requirements_ar =
66
65
  CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
67
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
66
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
68
67
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
69
68
  { name: 'High', abbreviation: 'H', weight: 1.51 },
70
69
  { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
data/lib/cvss_suite/cvss2/cvss2_temporal.rb CHANGED
@@ -11,19 +11,16 @@
11
11
  require_relative '../cvss_property'
12
12
  require_relative '../cvss_metric'
13
13
 
14
- ##
15
- # This class represents a CVSS Temporal metric in version 2.
16
-
17
14
  module CvssSuite
15
+ ##
16
+ # This class represents a CVSS Temporal metric in version 2.
18
17
  class Cvss2Temporal < CvssMetric
19
18
  ##
20
19
  # Property of this metric
21
-
22
20
  attr_reader :exploitability, :remediation_level, :report_confidence
23
21
 
24
22
  ##
25
23
  # Returns score of this metric
26
-
27
24
  def score
28
25
  return 1 unless valid?
29
26
 
@@ -35,14 +32,14 @@ module CvssSuite
35
32
  def init_properties
36
33
  @properties.push(@exploitability =
37
34
  CvssProperty.new(name: 'Exploitability', abbreviation: 'E', position: [6],
38
- choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
35
+ values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
39
36
  { name: 'Unproven', abbreviation: 'U', weight: 0.85 },
40
37
  { name: 'Proof-of-Concept', abbreviation: 'POC', weight: 0.9 },
41
38
  { name: 'Functional', abbreviation: 'F', weight: 0.95 },
42
39
  { name: 'High', abbreviation: 'H', weight: 1 }]))
43
40
  @properties.push(@remediation_level =
44
41
  CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [7],
45
- choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
42
+ values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
46
43
  { name: 'Official Fix', abbreviation: 'OF', weight: 0.87 },
47
44
  { name: 'Temporary Fix', abbreviation: 'TF', weight: 0.9 },
48
45
  { name: 'Workaround', abbreviation: 'W', weight: 0.95 },
@@ -50,7 +47,7 @@ module CvssSuite
50
47
 
51
48
  @properties.push(@report_confidence =
52
49
  CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [8],
53
- choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
50
+ values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
54
51
  { name: 'Unconfirmed', abbreviation: 'UC', weight: 0.9 },
55
52
  { name: 'Uncorroborated', abbreviation: 'UR', weight: 0.95 },
56
53
  { name: 'Confirmed', abbreviation: 'C', weight: 1 }]))
data/lib/cvss_suite/cvss3/cvss3.rb CHANGED
@@ -13,21 +13,18 @@ require_relative 'cvss3_base'
13
13
  require_relative 'cvss3_temporal'
14
14
  require_relative 'cvss3_environmental'
15
15
 
16
- ##
17
- # This class represents a CVSS vector in version 3.0.
18
-
19
16
  module CvssSuite
17
+ ##
18
+ # This class represents a CVSS vector in version 3.0.
20
19
  class Cvss3 < Cvss
21
20
  ##
22
21
  # Returns the Version of the CVSS vector.
23
-
24
22
  def version
25
23
  3.0
26
24
  end
27
25
 
28
26
  ##
29
27
  # Returns the Base Score of the CVSS vector.
30
-
31
28
  def base_score
32
29
  check_validity
33
30
  Cvss3Helper.round_up(@base.score)
@@ -35,18 +32,16 @@ module CvssSuite
35
32
 
36
33
  ##
37
34
  # Returns the Temporal Score of the CVSS vector.
38
-
39
35
  def temporal_score
40
36
  Cvss3Helper.round_up(Cvss3Helper.round_up(@base.score) * @temporal.score)
41
37
  end
42
38
 
43
39
  ##
44
40
  # Returns the Environmental Score of the CVSS vector.
45
-
46
41
  def environmental_score
47
42
  return temporal_score unless @environmental.valid?
48
43
 
49
- Cvss3Helper.round_up(@environmental.score(@base, @temporal))
44
+ Cvss3Helper.round_up(@environmental.score(@temporal.score))
50
45
  end
51
46
 
52
47
  private
data/lib/cvss_suite/cvss3/cvss3_base.rb CHANGED
@@ -12,28 +12,26 @@ require_relative '../cvss_property'
12
12
  require_relative '../cvss_metric'
13
13
  require_relative '../helpers/cvss3_helper'
14
14
 
15
- ##
16
- # This class represents a CVSS Base metric in version 3.
17
-
18
15
  module CvssSuite
16
+ ##
17
+ # This class represents a CVSS Base metric in version 3.
19
18
  class Cvss3Base < CvssMetric
20
19
  ##
21
20
  # Property of this metric
22
-
23
21
  attr_reader :attack_vector, :attack_complexity, :privileges_required, :user_interaction,
24
22
  :scope, :confidentiality, :integrity, :availability
25
23
 
26
24
  ##
27
25
  # Returns score of this metric
28
-
29
26
  def score
30
27
  privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
31
28
 
32
- exploitability = 8.22 * @attack_vector.score * @attack_complexity.score * privilege_score * @user_interaction.score
29
+ exploitability = 8.22 * @attack_vector.score * @attack_complexity.score *
30
+ privilege_score * @user_interaction.score
33
31
 
34
32
  isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
35
33
 
36
- impact_sub_score = if @scope.selected_choice[:name] == 'Changed'
34
+ impact_sub_score = if @scope.selected_value[:name] == 'Changed'
37
35
  7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
38
36
  else
39
37
  6.42 * isc_base
@@ -41,7 +39,7 @@ module CvssSuite
41
39
 
42
40
  return 0 if impact_sub_score <= 0
43
41
 
44
- if @scope.selected_choice[:name] == 'Changed'
42
+ if @scope.selected_value[:name] == 'Changed'
45
43
  [10, 1.08 * (impact_sub_score + exploitability)].min
46
44
  else
47
45
  [10, impact_sub_score + exploitability].min
@@ -53,40 +51,40 @@ module CvssSuite
53
51
  def init_properties
54
52
  @properties.push(@attack_vector =
55
53
  CvssProperty.new(name: 'Attack Vector', abbreviation: 'AV', position: [0],
56
- choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
54
+ values: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
57
55
  { name: 'Adjacent', abbreviation: 'A', weight: 0.62 },
58
56
  { name: 'Local', abbreviation: 'L', weight: 0.55 },
59
57
  { name: 'Physical', abbreviation: 'P', weight: 0.2 }]))
60
58
  @properties.push(@attack_complexity =
61
59
  CvssProperty.new(name: 'Attack Complexity', abbreviation: 'AC', position: [1],
62
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
60
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
63
61
  { name: 'High', abbreviation: 'H', weight: 0.44 }]))
64
62
  @properties.push(@privileges_required =
65
63
  CvssProperty.new(name: 'Privileges Required', abbreviation: 'PR', position: [2],
66
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
64
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
67
65
  { name: 'Low', abbreviation: 'L', weight: 0.62 },
68
66
  { name: 'High', abbreviation: 'H', weight: 0.27 }]))
69
67
  @properties.push(@user_interaction =
70
68
  CvssProperty.new(name: 'User Interaction', abbreviation: 'UI', position: [3],
71
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
69
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
72
70
  { name: 'Required', abbreviation: 'R', weight: 0.62 }]))
73
71
  @properties.push(@scope =
74
72
  CvssProperty.new(name: 'Scope', abbreviation: 'S', position: [4],
75
- choices: [{ name: 'Unchanged', abbreviation: 'U' },
73
+ values: [{ name: 'Unchanged', abbreviation: 'U' },
76
74
  { name: 'Changed', abbreviation: 'C' }]))
77
75
  @properties.push(@confidentiality =
78
76
  CvssProperty.new(name: 'Confidentiality', abbreviation: 'C', position: [5],
79
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
77
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
80
78
  { name: 'Low', abbreviation: 'L', weight: 0.22 },
81
79
  { name: 'High', abbreviation: 'H', weight: 0.56 }]))
82
80
  @properties.push(@integrity =
83
81
  CvssProperty.new(name: 'Integrity', abbreviation: 'I', position: [6],
84
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
82
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
85
83
  { name: 'Low', abbreviation: 'L', weight: 0.22 },
86
84
  { name: 'High', abbreviation: 'H', weight: 0.56 }]))
87
85
  @properties.push(@availability =
88
86
  CvssProperty.new(name: 'Availability', abbreviation: 'A', position: [7],
89
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
87
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
90
88
  { name: 'Low', abbreviation: 'L', weight: 0.22 },
91
89
  { name: 'High', abbreviation: 'H', weight: 0.56 }]))
92
90
  end
data/lib/cvss_suite/cvss3/cvss3_environmental.rb CHANGED
@@ -12,14 +12,12 @@ require_relative '../cvss_property'
12
12
  require_relative '../cvss_metric'
13
13
  require_relative '../helpers/cvss3_helper'
14
14
 
15
- ##
16
- # This class represents a CVSS Environmental metric in version 3.
17
-
18
15
  module CvssSuite
16
+ ##
17
+ # This class represents a CVSS Environmental metric in version 3.
19
18
  class Cvss3Environmental < CvssMetric
20
19
  ##
21
20
  # Property of this metric
22
-
23
21
  attr_reader :confidentiality_requirement, :integrity_requirement, :availability_requirement,
24
22
  :modified_attack_vector, :modified_attack_complexity, :modified_privileges_required,
25
23
  :modified_user_interaction, :modified_scope, :modified_confidentiality,
@@ -28,20 +26,8 @@ module CvssSuite
28
26
  ##
29
27
  # Returns score of this metric
30
28
 
31
- def score(base, temporal)
32
- @base = base
33
-
34
- merged_modified_privileges_required = @modified_privileges_required
35
- if @modified_privileges_required.selected_choice[:name] == 'Not Defined'
36
- merged_modified_privileges_required = @base.privileges_required
37
- end
38
-
39
- merged_modified_scope = @modified_scope
40
- if @modified_scope.selected_choice[:name] == 'Not Defined'
41
- merged_modified_scope = @base.scope
42
- end
43
-
44
- privilege_score = Cvss3Helper.privileges_required_score(merged_modified_privileges_required, merged_modified_scope)
29
+ def score(temporal_score)
30
+ privilege_score = Cvss3Helper.privileges_required_score(@modified_privileges_required, @modified_scope)
45
31
 
46
32
  modified_exploitability_sub_score = modified_exploitability_sub(privilege_score)
47
33
 
@@ -49,7 +35,7 @@ module CvssSuite
49
35
 
50
36
  return 0 if modified_impact_sub_score <= 0
51
37
 
52
- calculate_score modified_impact_sub_score, modified_exploitability_sub_score, temporal.score
38
+ calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
53
39
  end
54
40
 
55
41
  private
@@ -57,81 +43,72 @@ module CvssSuite
57
43
  def init_properties
58
44
  @properties.push(@confidentiality_requirement =
59
45
  CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
60
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
46
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
61
47
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
62
48
  { name: 'High', abbreviation: 'H', weight: 1.5 },
63
49
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
64
50
  @properties.push(@integrity_requirement =
65
51
  CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
66
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
52
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
67
53
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
68
54
  { name: 'High', abbreviation: 'H', weight: 1.5 },
69
55
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
70
56
 
71
57
  @properties.push(@availability_requirement =
72
58
  CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
73
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
59
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
74
60
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
75
61
  { name: 'High', abbreviation: 'H', weight: 1.5 },
76
62
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
77
63
  @properties.push(@modified_attack_vector =
78
64
  CvssProperty.new(name: 'Modified Attack Vector', abbreviation: 'MAV', position: [11, 14],
79
- choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
65
+ values: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
80
66
  { name: 'Adjacent Network', abbreviation: 'A', weight: 0.62 },
81
67
  { name: 'Local', abbreviation: 'L', weight: 0.55 },
82
68
  { name: 'Physical', abbreviation: 'P', weight: 0.2 },
83
69
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
84
70
  @properties.push(@modified_attack_complexity =
85
71
  CvssProperty.new(name: 'Modified Attack Complexity', abbreviation: 'MAC', position: [12, 15],
86
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
72
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
87
73
  { name: 'High', abbreviation: 'H', weight: 0.44 },
88
74
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
89
75
  @properties.push(@modified_privileges_required =
90
76
  CvssProperty.new(name: 'Modified Privileges Required', abbreviation: 'MPR', position: [13, 16],
91
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
77
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
92
78
  { name: 'Low', abbreviation: 'L', weight: 0.62 },
93
79
  { name: 'High', abbreviation: 'H', weight: 0.27 },
94
80
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
95
81
  @properties.push(@modified_user_interaction =
96
82
  CvssProperty.new(name: 'Modified User Interaction', abbreviation: 'MUI', position: [14, 17],
97
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
83
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
98
84
  { name: 'Required', abbreviation: 'R', weight: 0.62 },
99
85
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
100
86
  @properties.push(@modified_scope =
101
87
  CvssProperty.new(name: 'Modified Scope', abbreviation: 'MS', position: [15, 18],
102
- choices: [{ name: 'Changed', abbreviation: 'C' },
103
- { name: 'Unchanged', abbreviation: 'U' },
104
- { name: 'Not Defined', abbreviation: 'X' }]))
88
+ values: [{ name: 'Changed', abbreviation: 'C' },
89
+ { name: 'Unchanged', abbreviation: 'U' }]))
105
90
  @properties.push(@modified_confidentiality =
106
91
  CvssProperty.new(name: 'Modified Confidentiality', abbreviation: 'MC', position: [16, 19],
107
- choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
92
+ values: [{ name: 'None', abbreviation: 'N', weight: 0 },
108
93
  { name: 'Low', abbreviation: 'L', weight: 0.22 },
109
94
  { name: 'High', abbreviation: 'H', weight: 0.56 },
110
95
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
111
96
  @properties.push(@modified_integrity =
112
97
  CvssProperty.new(name: 'Modified Integrity', abbreviation: 'MI', position: [17, 20],
113
- choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
98
+ values: [{ name: 'None', abbreviation: 'N', weight: 0 },
114
99
  { name: 'Low', abbreviation: 'L', weight: 0.22 },
115
100
  { name: 'High', abbreviation: 'H', weight: 0.56 },
116
101
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
117
102
  @properties.push(@modified_availability =
118
103
  CvssProperty.new(name: 'Modified Availability', abbreviation: 'MA', position: [18, 21],
119
- choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
104
+ values: [{ name: 'None', abbreviation: 'N', weight: 0 },
120
105
  { name: 'Low', abbreviation: 'L', weight: 0.22 },
121
106
  { name: 'High', abbreviation: 'H', weight: 0.56 },
122
107
  { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
123
108
  end
124
109
 
125
110
  def modified_impact_sub(isc_modified)
126
- if @modified_scope.selected_choice[:name] == 'Not Defined'
127
- if @base.scope.selected_choice[:name] == 'Changed'
128
- return 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
129
- else
130
- return 6.42 * isc_modified
131
- end
132
- end
133
-
134
- if @modified_scope.selected_choice[:name] == 'Changed'
111
+ if @modified_scope.selected_value[:name] == 'Changed'
135
112
  7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
136
113
  else
137
114
  6.42 * isc_modified
@@ -139,54 +116,20 @@ module CvssSuite
139
116
  end
140
117
 
141
118
  def isc_modified
142
- merged_modified_confidentiality = @modified_confidentiality
143
- if @modified_confidentiality.selected_choice[:name] == 'Not Defined'
144
- merged_modified_confidentiality = @base.confidentiality
145
- end
146
-
147
- merged_modified_integrity = @modified_integrity
148
- if @modified_integrity.selected_choice[:name] == 'Not Defined'
149
- merged_modified_integrity = @base.integrity
150
- end
151
-
152
- merged_modified_availability = @modified_availability
153
- if @modified_availability.selected_choice[:name] == 'Not Defined'
154
- merged_modified_availability = @base.availability
155
- end
156
-
157
- confidentiality_score = 1 - merged_modified_confidentiality.score * @confidentiality_requirement.score
158
- integrity_score = 1 - merged_modified_integrity.score * @integrity_requirement.score
159
- availability_score = 1 - merged_modified_availability.score * @availability_requirement.score
119
+ confidentiality_score = 1 - @modified_confidentiality.score * @confidentiality_requirement.score
120
+ integrity_score = 1 - @modified_integrity.score * @integrity_requirement.score
121
+ availability_score = 1 - @modified_availability.score * @availability_requirement.score
160
122
 
161
123
  [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
162
124
  end
163
125
 
164
126
  def modified_exploitability_sub(privilege_score)
165
- merged_modified_attack_vector = @modified_attack_vector
166
- if @modified_attack_vector.selected_choice[:name] == 'Not Defined'
167
- merged_modified_attack_vector = @base.attack_vector
168
- end
169
-
170
- merged_modified_attack_complexity = @modified_attack_complexity
171
- if @modified_attack_complexity.selected_choice[:name] == 'Not Defined'
172
- merged_modified_attack_complexity = @base.attack_complexity
173
- end
174
-
175
- merged_modified_user_interaction = @modified_user_interaction
176
- if @modified_user_interaction.selected_choice[:name] == 'Not Defined'
177
- merged_modified_user_interaction = @base.user_interaction
178
- end
179
-
180
- 8.22 * merged_modified_attack_vector.score * merged_modified_attack_complexity.score *
181
- privilege_score * merged_modified_user_interaction.score
127
+ 8.22 * @modified_attack_vector.score * @modified_attack_complexity.score *
128
+ privilege_score * @modified_user_interaction.score
182
129
  end
183
130
 
184
131
  def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
185
- if @modified_scope.selected_choice[:name] == 'Not Defined'
186
- factor = @base.scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
187
- else
188
- factor = @modified_scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
189
- end
132
+ factor = @modified_scope.selected_value[:name] == 'Changed' ? 1.08 : 1.0
190
133
 
191
134
  Cvss3Helper.round_up(
192
135
  [factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min