cvss-suite 4.1.3 → 5.0.0

data/lib/cvss_suite/cvss.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -12,13 +14,17 @@ module CvssSuite
     attr_reader :base
 
     ##
-    # Creates a new CVSS vector by a +vector+.
+    # Creates a new CVSS vector by a +vector+. CvssSuite.new also passes the
+    # +original+ string it was handed, because +vector+ reaches here with the
+    # CVSS:x.x/ prefix or the CVSS 2 parentheses already stripped, and an error
+    # has to name the vector the caller actually wrote.
     #
     # Raises an exception if it is called on Cvss class.
-    def initialize(vector)
+    def initialize(vector, original = vector)
       raise CvssSuite::Errors::InvalidParentClass, 'Do not instantiate this class!' if instance_of? Cvss
 
       @vector = vector
+      @original = original
       @properties = []
       extract_metrics
       init_metrics
@@ -31,6 +37,9 @@ module CvssSuite
 
       score = overall_score
 
+      # The explicit `<= 0.0` branch and the defensive `else` both yield 'None' by
+      # design (zero score vs. out-of-range guard); kept distinct for readability.
+      # rubocop:disable-next Lint/DuplicateBranch
       if score <= 0.0
         'None'
       elsif (0.1..3.9).cover? score
@@ -65,7 +74,15 @@ module CvssSuite
     end
 
     def check_validity
-      raise CvssSuite::Errors::InvalidVector, 'Vector is not valid!' unless valid?
+      raise CvssSuite::Errors::InvalidVector.for(rejected_vector) unless valid?
+    end
+
+    # What the caller passed, not the normalized form. #vector would be the
+    # tempting source, but it is lossy: Cvss2 does not restore the parentheses
+    # that prepare_cvss2_vector strips, so a rejected '(AV:N/AC:L)' would be
+    # reported as 'AV:N/AC:L', and a paren form it cannot parse at all as ''.
+    def rejected_vector
+      @original
     end
 
     def required_amount_of_properties

data/lib/cvss_suite/cvss2/cvss2.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -55,6 +57,7 @@ module CvssSuite
     ##
     # Returns the Environmental Score of the CVSS vector.
     def environmental_score
+      check_validity
       return temporal_score unless @environmental.valid?
 
       (@environmental.score @base, @temporal.score).round(1)

data/lib/cvss_suite/cvss2/cvss2_base.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -19,6 +21,9 @@ module CvssSuite
     # Returns the base score of the CVSS vector. The calculation is based on formula version 2.10 .
     # See CVSS documentation for further information https://www.first.org/cvss/v2/guide#i3.2.1 .
     #
+    # BaseScore = ((0.6 x Impact) + (0.4 x Exploitability) - 1.5) x f(Impact),
+    # where f(Impact) = 0 when Impact is 0, else 1.176.
+    #
     # Takes +Security+ +Requirement+ +Impacts+ for calculating environmental score.
     def score(sr_cr_score = 1, sr_ir_score = 1, sr_ar_score = 1)
       impact = calc_impact(sr_cr_score, sr_ir_score, sr_ar_score)
@@ -73,17 +78,23 @@ module CvssSuite
                                                    { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
     end
 
+    # CVSS v2, 3.2.1 -- Impact = 10.41 x (1 - (1-C) x (1-I) x (1-A)).
+    # The sr_* args carry the environmental Security Requirements (3.3.1),
+    # defaulting to 1 (= no environmental adjustment) for the plain base score.
+    # https://www.first.org/cvss/v2/guide#i3.2.1
     def calc_impact(sr_cr_score = 1, sr_ir_score = 1, sr_ar_score = 1)
-      confidentiality_score = 1 - @confidentiality_impact.score * sr_cr_score
-      integrity_score = 1 - @integrity_impact.score * sr_ir_score
-      availability_score = 1 - @availability_impact.score * sr_ar_score
+      confidentiality_score = 1 - (@confidentiality_impact.score * sr_cr_score)
+      integrity_score = 1 - (@integrity_impact.score * sr_ir_score)
+      availability_score = 1 - (@availability_impact.score * sr_ar_score)
 
-      impact = 10.41 * (1 - confidentiality_score * integrity_score * availability_score)
+      impact = 10.41 * (1 - (confidentiality_score * integrity_score * availability_score))
       return impact if sr_cr_score == 1 && sr_ir_score == 1 && sr_ar_score == 1
 
       [10, impact].min
     end
 
+    # CVSS v2, 3.2.1 -- Exploitability = 20 x AccessVector x AccessComplexity x Authentication.
+    # https://www.first.org/cvss/v2/guide#i3.2.1
     def calc_exploitability
       20 * @access_vector.score * @access_complexity.score * @authentication.score
     end

data/lib/cvss_suite/cvss2/cvss2_environmental.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -25,7 +27,7 @@ module CvssSuite
                               @security_requirements_ar.score).round(1)
 
       adjusted_temporal = (base_score * temporal_score.to_d).round(1).to_f
-      (adjusted_temporal + (10 - adjusted_temporal) * @collateral_damage_potential.score) * @target_distribution.score
+      (adjusted_temporal + ((10 - adjusted_temporal) * @collateral_damage_potential.score)) * @target_distribution.score
     end
 
     private

data/lib/cvss_suite/cvss2/cvss2_temporal.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.

data/lib/cvss_suite/cvss3/cvss3.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -28,12 +30,14 @@ module CvssSuite
     ##
     # Returns the Temporal Score of the CVSS vector.
     def temporal_score
+      check_validity
       Cvss3Helper.round_up(Cvss3Helper.round_up(@base.score) * @temporal.score)
     end
 
     ##
     # Returns the Environmental Score of the CVSS vector.
     def environmental_score
+      check_validity
       return temporal_score unless @environmental.valid?
 
       Cvss3Helper.round_up(@environmental.score(@base, @temporal))

data/lib/cvss_suite/cvss3/cvss3_base.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -82,6 +84,9 @@ module CvssSuite
                                                    { name: 'High', abbreviation: 'H', weight: 0.56 }]))
     end
 
+    # CVSS v3.0 spec, 8.1 Base Metrics Equations -- Exploitability sub-score:
+    #   8.22 x AttackVector x AttackComplexity x PrivilegesRequired x UserInteraction
+    # https://www.first.org/cvss/v3.0/specification-document
     def calc_exploitability
       privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
 
@@ -89,11 +94,16 @@ module CvssSuite
         privilege_score * @user_interaction.score
     end
 
+    # CVSS v3.0 spec, 8.1 Base Metrics Equations -- Impact sub-score:
+    #   ISCBase = 1 - [(1-C) x (1-I) x (1-A)]
+    #   Scope Changed:   7.52 x (ISCBase - 0.029) - 3.25 x (ISCBase - 0.02)^15
+    #   Scope Unchanged: 6.42 x ISCBase
+    # https://www.first.org/cvss/v3.0/specification-document
     def calc_impact
       isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
 
       if @scope.selected_value[:name] == 'Changed'
-        7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
+        (7.52 * (isc_base - 0.029)) - (3.25 * ((isc_base - 0.02)**15))
       else
         6.42 * isc_base
       end

data/lib/cvss_suite/cvss3/cvss3_environmental.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -24,17 +26,10 @@ module CvssSuite
     def score(base, temporal)
       @base = base
 
-      merged_modified_privileges_required = @modified_privileges_required
-      if @modified_privileges_required.selected_value[:name] == 'Not Defined'
-        merged_modified_privileges_required = @base.privileges_required
-      end
-
-      merged_modified_scope = @modified_scope
-      if @modified_scope.selected_value[:name] == 'Not Defined'
-        merged_modified_scope = @base.scope
-      end
-
-      privilege_score = Cvss3Helper.privileges_required_score(merged_modified_privileges_required, merged_modified_scope)
+      privilege_score = Cvss3Helper.privileges_required_score(
+        merged(@modified_privileges_required, @base.privileges_required),
+        merged(@modified_scope, @base.scope)
+      )
 
       modified_exploitability_sub_score = modified_exploitability_sub(privilege_score)
 
@@ -47,6 +42,18 @@ module CvssSuite
 
     private
 
+    # Returns the modified property, falling back to the base property when the
+    # modified metric is "Not Defined".
+    def merged(modified, base)
+      modified.selected_value[:name] == 'Not Defined' ? base : modified
+    end
+
+    # Whether the effective scope -- the modified scope, or the base scope when
+    # the modified scope is "Not Defined" -- is Changed.
+    def scope_changed?
+      merged(@modified_scope, @base.scope).selected_value[:name] == 'Changed'
+    end
+
     def init_properties
       @properties.push(@confidentiality_requirement =
                          CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR',
@@ -115,71 +122,47 @@ module CvssSuite
                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
     end
 
+    # CVSS v3.0 spec, 8.3 Environmental -- ModifiedImpact from the MISS below:
+    #   Scope Changed:   7.52 x (MISS - 0.029) - 3.25 x (MISS - 0.02)^15
+    #   Scope Unchanged: 6.42 x MISS
+    # https://www.first.org/cvss/v3.0/specification-document
     def modified_impact_sub(isc_modified)
-      if @modified_scope.selected_value[:name] == 'Not Defined'
-        if @base.scope.selected_value[:name] == 'Changed'
-          return 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
-        else
-          return 6.42 * isc_modified
-        end
-      end
-
-      if @modified_scope.selected_value[:name] == 'Changed'
-        7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified - 0.02)**15
+      if scope_changed?
+        (7.52 * (isc_modified - 0.029)) - (3.25 * ((isc_modified - 0.02)**15))
       else
         6.42 * isc_modified
       end
     end
 
+    # CVSS v3.0 spec, 8.3 Environmental -- Modified Impact Sub-Score (MISS):
+    #   Minimum(1 - [(1 - MC x CR) x (1 - MI x IR) x (1 - MA x AR)], 0.915)
     def isc_modified
-      merged_modified_confidentiality = @modified_confidentiality
-      if @modified_confidentiality.selected_value[:name] == 'Not Defined'
-        merged_modified_confidentiality = @base.confidentiality
-      end
+      confidentiality = merged(@modified_confidentiality, @base.confidentiality)
+      integrity = merged(@modified_integrity, @base.integrity)
+      availability = merged(@modified_availability, @base.availability)
 
-      merged_modified_integrity = @modified_integrity
-      if @modified_integrity.selected_value[:name] == 'Not Defined'
-        merged_modified_integrity = @base.integrity
-      end
-
-      merged_modified_availability = @modified_availability
-      if @modified_availability.selected_value[:name] == 'Not Defined'
-        merged_modified_availability = @base.availability
-      end
+      confidentiality_score = 1 - (confidentiality.score * @confidentiality_requirement.score)
+      integrity_score = 1 - (integrity.score * @integrity_requirement.score)
+      availability_score = 1 - (availability.score * @availability_requirement.score)
 
-      confidentiality_score = 1 - merged_modified_confidentiality.score * @confidentiality_requirement.score
-      integrity_score = 1 - merged_modified_integrity.score * @integrity_requirement.score
-      availability_score = 1 - merged_modified_availability.score * @availability_requirement.score
-
-      [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
+      [0.915, (1 - (confidentiality_score * integrity_score * availability_score))].min
     end
 
+    # CVSS v3.0 spec, 8.3 Environmental -- ModifiedExploitability:
+    #   8.22 x MAV x MAC x MPR x MUI
     def modified_exploitability_sub(privilege_score)
-      merged_modified_attack_vector = @modified_attack_vector
-      if @modified_attack_vector.selected_value[:name] == 'Not Defined'
-        merged_modified_attack_vector = @base.attack_vector
-      end
+      attack_vector = merged(@modified_attack_vector, @base.attack_vector)
+      attack_complexity = merged(@modified_attack_complexity, @base.attack_complexity)
+      user_interaction = merged(@modified_user_interaction, @base.user_interaction)
 
-      merged_modified_attack_complexity = @modified_attack_complexity
-      if @modified_attack_complexity.selected_value[:name] == 'Not Defined'
-        merged_modified_attack_complexity = @base.attack_complexity
-      end
-
-      merged_modified_user_interaction = @modified_user_interaction
-      if @modified_user_interaction.selected_value[:name] == 'Not Defined'
-        merged_modified_user_interaction = @base.user_interaction
-      end
-
-      8.22 * merged_modified_attack_vector.score * merged_modified_attack_complexity.score *
-        privilege_score * merged_modified_user_interaction.score
+      8.22 * attack_vector.score * attack_complexity.score * privilege_score * user_interaction.score
     end
 
+    # CVSS v3.0 spec, 8.3 Environmental -- ModifiedScore = Roundup(Minimum(
+    #   [1.08 x] (ModifiedImpact + ModifiedExploitability), 10)) x TemporalScore.
+    #   The 1.08 factor applies when the effective (modified) scope is Changed.
     def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
-      if @modified_scope.selected_value[:name] == 'Not Defined'
-        factor = @base.scope.selected_value[:name] == 'Changed' ? 1.08 : 1.0
-      else
-        factor = @modified_scope.selected_value[:name] == 'Changed' ? 1.08 : 1.0
-      end
+      factor = scope_changed? ? 1.08 : 1.0
 
       Cvss3Helper.round_up(
         [factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min

data/lib/cvss_suite/cvss3/cvss3_temporal.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.

data/lib/cvss_suite/cvss31/cvss31.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -32,6 +34,7 @@ module CvssSuite
     # Returns the Temporal Score of the CVSS vector.
 
     def temporal_score
+      check_validity
       Cvss31Helper.round_up(Cvss31Helper.round_up(@base.score) * @temporal.score)
     end
 
@@ -39,6 +42,7 @@ module CvssSuite
     # Returns the Environmental Score of the CVSS vector.
 
     def environmental_score
+      check_validity
       return temporal_score unless @environmental.valid?
 
       Cvss31Helper.round_up(@environmental.score(@base, @temporal))

data/lib/cvss_suite/cvss31/cvss31_base.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -83,6 +85,9 @@ module CvssSuite
                                                    { name: 'High', abbreviation: 'H', weight: 0.56 }]))
     end
 
+    # CVSS v3.1 spec, 7.1 Base Metrics Equations -- Exploitability sub-score:
+    #   8.22 x AttackVector x AttackComplexity x PrivilegesRequired x UserInteraction
+    # https://www.first.org/cvss/v3.1/specification-document
     def calc_exploitability
       privilege_score = Cvss3Helper.privileges_required_score(@privileges_required, @scope)
 
@@ -90,11 +95,20 @@ module CvssSuite
         privilege_score * @user_interaction.score
     end
 
+    # CVSS v3.1 spec, 7.1 Base Metrics Equations -- Impact sub-score:
+    #   ISCBase = 1 - [(1-C) x (1-I) x (1-A)]
+    #   Scope Changed:   7.52 x (ISCBase - 0.029) - 3.25 x (ISCBase - 0.02)^15
+    #   Scope Unchanged: 6.42 x ISCBase
+    # NOTE: v3.1 Base deliberately keeps the exponent 15 from v3.0. Only the
+    # Environmental ModifiedImpact (spec 7.3, see cvss31_environmental.rb) changed
+    # to `x 0.9731` and exponent 13. The two are intentionally different -- do not
+    # "reconcile" them.
+    # https://www.first.org/cvss/v3.1/specification-document
     def calc_impact
       isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
 
       if @scope.selected_value[:name] == 'Changed'
-        7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
+        (7.52 * (isc_base - 0.029)) - (3.25 * ((isc_base - 0.02)**15))
       else
         6.42 * isc_base
       end

data/lib/cvss_suite/cvss31/cvss31_environmental.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -24,17 +26,10 @@ module CvssSuite
     def score(base, temporal)
       @base = base
 
-      merged_modified_privileges_required = @modified_privileges_required
-      if @modified_privileges_required.selected_value[:name] == 'Not Defined'
-        merged_modified_privileges_required = @base.privileges_required
-      end
-
-      merged_modified_scope = @modified_scope
-      if @modified_scope.selected_value[:name] == 'Not Defined'
-        merged_modified_scope = @base.scope
-      end
-
-      privilege_score = Cvss3Helper.privileges_required_score(merged_modified_privileges_required, merged_modified_scope)
+      privilege_score = Cvss3Helper.privileges_required_score(
+        merged(@modified_privileges_required, @base.privileges_required),
+        merged(@modified_scope, @base.scope)
+      )
 
       modified_exploitability_sub_score = modified_exploitability_sub(privilege_score)
 
@@ -47,6 +42,18 @@ module CvssSuite
 
     private
 
+    # Returns the modified property, falling back to the base property when the
+    # modified metric is "Not Defined".
+    def merged(modified, base)
+      modified.selected_value[:name] == 'Not Defined' ? base : modified
+    end
+
+    # Whether the effective scope -- the modified scope, or the base scope when
+    # the modified scope is "Not Defined" -- is Changed.
+    def scope_changed?
+      merged(@modified_scope, @base.scope).selected_value[:name] == 'Changed'
+    end
+
     def init_properties
       @properties.push(@confidentiality_requirement =
                          CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR',
@@ -115,71 +122,50 @@ module CvssSuite
                                                    { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
     end
 
+    # CVSS v3.1 spec, 7.3 Environmental -- ModifiedImpact from the MISS below:
+    #   Scope Changed:   7.52 x (MISS - 0.029) - 3.25 x (MISS x 0.9731 - 0.02)^13
+    #   Scope Unchanged: 6.42 x MISS
+    # NOTE: v3.1 changed this Environmental sub-formula to `x 0.9731` and exponent
+    # 13; the v3.1 Base Impact (7.1, see cvss31_base.rb) still uses exponent 15.
+    # The difference is intentional per spec.
+    # https://www.first.org/cvss/v3.1/specification-document
     def modified_impact_sub(isc_modified)
-      if @modified_scope.selected_value[:name] == 'Not Defined'
-        if @base.scope.selected_value[:name] == 'Changed'
-          return 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified * 0.9731 - 0.02)**13
-        else
-          return 6.42 * isc_modified
-        end
-      end
-
-      if @modified_scope.selected_value[:name] == 'Changed'
-        7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified * 0.9731 - 0.02)**13
+      if scope_changed?
+        (7.52 * (isc_modified - 0.029)) - (3.25 * (((isc_modified * 0.9731) - 0.02)**13))
       else
         6.42 * isc_modified
       end
     end
 
+    # CVSS v3.1 spec, 7.3 Environmental -- Modified Impact Sub-Score (MISS):
+    #   Minimum(1 - [(1 - MC x CR) x (1 - MI x IR) x (1 - MA x AR)], 0.915)
     def isc_modified
-      merged_modified_confidentiality = @modified_confidentiality
-      if @modified_confidentiality.selected_value[:name] == 'Not Defined'
-        merged_modified_confidentiality = @base.confidentiality
-      end
+      confidentiality = merged(@modified_confidentiality, @base.confidentiality)
+      integrity = merged(@modified_integrity, @base.integrity)
+      availability = merged(@modified_availability, @base.availability)
 
-      merged_modified_integrity = @modified_integrity
-      if @modified_integrity.selected_value[:name] == 'Not Defined'
-        merged_modified_integrity = @base.integrity
-      end
-
-      merged_modified_availability = @modified_availability
-      if @modified_availability.selected_value[:name] == 'Not Defined'
-        merged_modified_availability = @base.availability
-      end
+      confidentiality_score = 1 - (confidentiality.score * @confidentiality_requirement.score)
+      integrity_score = 1 - (integrity.score * @integrity_requirement.score)
+      availability_score = 1 - (availability.score * @availability_requirement.score)
 
-      confidentiality_score = 1 - merged_modified_confidentiality.score * @confidentiality_requirement.score
-      integrity_score = 1 - merged_modified_integrity.score * @integrity_requirement.score
-      availability_score = 1 - merged_modified_availability.score * @availability_requirement.score
-
-      [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
+      [0.915, (1 - (confidentiality_score * integrity_score * availability_score))].min
     end
 
+    # CVSS v3.1 spec, 7.3 Environmental -- ModifiedExploitability:
+    #   8.22 x MAV x MAC x MPR x MUI
     def modified_exploitability_sub(privilege_score)
-      merged_modified_attack_vector = @modified_attack_vector
-      if @modified_attack_vector.selected_value[:name] == 'Not Defined'
-        merged_modified_attack_vector = @base.attack_vector
-      end
+      attack_vector = merged(@modified_attack_vector, @base.attack_vector)
+      attack_complexity = merged(@modified_attack_complexity, @base.attack_complexity)
+      user_interaction = merged(@modified_user_interaction, @base.user_interaction)
 
-      merged_modified_attack_complexity = @modified_attack_complexity
-      if @modified_attack_complexity.selected_value[:name] == 'Not Defined'
-        merged_modified_attack_complexity = @base.attack_complexity
-      end
-
-      merged_modified_user_interaction = @modified_user_interaction
-      if @modified_user_interaction.selected_value[:name] == 'Not Defined'
-        merged_modified_user_interaction = @base.user_interaction
-      end
-
-      8.22 * merged_modified_attack_vector.score * merged_modified_attack_complexity.score *
-        privilege_score * merged_modified_user_interaction.score
+      8.22 * attack_vector.score * attack_complexity.score * privilege_score * user_interaction.score
     end
 
+    # CVSS v3.1 spec, 7.3 Environmental -- ModifiedScore = Roundup(Minimum(
+    #   [1.08 x] (ModifiedImpact + ModifiedExploitability), 10)) x TemporalScore.
+    #   The 1.08 factor applies when the effective (modified) scope is Changed.
     def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
-      if @modified_scope.selected_value[:name] == 'Not Defined'
-        factor = @base.scope.selected_value[:name] == 'Changed' ? 1.08 : 1.0
-      else
-        factor = @modified_scope.selected_value[:name] == 'Changed' ? 1.08 : 1.0
-      end
+      factor = scope_changed? ? 1.08 : 1.0
 
       Cvss31Helper.round_up(
         [factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min

data/lib/cvss_suite/cvss31/cvss31_temporal.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.

data/lib/cvss_suite/cvss40/cvss40.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -28,6 +30,14 @@ module CvssSuite
       "#{CvssSuite::CVSS_VECTOR_BEGINNINGS.find { |beginning| beginning[:version] == version }[:string]}#{@vector}"
     end
 
+    ##
+    # Returns the base score of the CVSS vector, ignoring threat and
+    # environmental metrics -- the base score as published by NVD/GHSA.
+    def base_score
+      check_validity
+      @base.score
+    end
+
     private
 
     def init_metrics

data/lib/cvss_suite/cvss40/cvss40_all_up.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -15,7 +17,7 @@ module CvssSuite
     ##
     # Returns score of this metric
     def score
-      Cvss40CalcHelper.new(@properties.map { |p| [p.abbreviation, p.selected_value[:abbreviation]] }.to_h).score
+      Cvss40CalcHelper.new(@properties.to_h { |p| [p.abbreviation, p.selected_value[:abbreviation]] }).score
     end
 
     def initialize(properties, base, threat, environmental, environmental_security, supplemental)

data/lib/cvss_suite/cvss40/cvss40_base.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
 # This work is licensed under the terms of the MIT license.
@@ -18,6 +20,12 @@ module CvssSuite
                 :vulnerable_system_confidentiality, :vulnerable_system_integrity, :vulnerable_system_availability,
                 :subsequent_system_confidentiality, :subsequent_system_integrity, :subsequent_system_availability
 
+    ##
+    # Returns the base score of these metrics, ignoring threat and environmental metrics.
+    def score
+      Cvss40CalcHelper.new(@properties.to_h { |p| [p.abbreviation, p.selected_value[:abbreviation]] }).score
+    end
+
     private
 
     def init_properties