@ulisesgascon/openjs-cna-tools 0.0.0-stage → 1.0.0-alpha.3

package/lib/review/schemas/imports/cvss/cvss-v4.0.json

@@ -0,0 +1,784 @@
+{
+	"license": [
+		"Copyright (c) 2023, FIRST.ORG, INC.",
+		"All rights reserved.",
+		"",
+		"Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
+		"following conditions are met:",
+		"1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
+		"   disclaimer.",
+		"2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
+		"   following disclaimer in the documentation and/or other materials provided with the distribution.",
+		"3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
+		"   products derived from this software without specific prior written permission.",
+		"",
+		"THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
+		"INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
+		"DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
+		"SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
+		"SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
+		"WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
+		"OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
+	],
+	"$schema": "http://json-schema.org/draft-07/schema#",
+	"title": "JSON Schema for Common Vulnerability Scoring System version 4.0",
+	"$id": "https://www.first.org/cvss/cvss-v4.0.json?20231011",
+	"type": "object",
+	"definitions": {
+		"attackVectorType": {
+			"type": "string",
+			"enum": [
+				"NETWORK",
+				"ADJACENT",
+				"LOCAL",
+				"PHYSICAL"
+			]
+		},
+		"modifiedAttackVectorType": {
+			"type": "string",
+			"enum": [
+				"NETWORK",
+				"ADJACENT",
+				"LOCAL",
+				"PHYSICAL",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"attackComplexityType": {
+			"type": "string",
+			"enum": [
+				"HIGH",
+				"LOW"
+			]
+		},
+		"modifiedAttackComplexityType": {
+			"type": "string",
+			"enum": [
+				"HIGH",
+				"LOW",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"attackRequirementsType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"PRESENT"
+			]
+		},
+		"modifiedAttackRequirementsType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"PRESENT",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"privilegesRequiredType": {
+			"type": "string",
+			"enum": [
+				"HIGH",
+				"LOW",
+				"NONE"
+			]
+		},
+		"modifiedPrivilegesRequiredType": {
+			"type": "string",
+			"enum": [
+				"HIGH",
+				"LOW",
+				"NONE",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"userInteractionType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"PASSIVE",
+				"ACTIVE"
+			]
+		},
+		"modifiedUserInteractionType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"PASSIVE",
+				"ACTIVE",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"vulnCiaType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"LOW",
+				"HIGH"
+			]
+		},
+		"modifiedVulnCiaType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"LOW",
+				"HIGH",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"subCiaType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"LOW",
+				"HIGH"
+			]
+		},
+		"modifiedSubCType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"LOW",
+				"HIGH",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"modifiedSubIaType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"LOW",
+				"HIGH",
+				"SAFETY",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"exploitMaturityType": {
+			"type": "string",
+			"enum": [
+				"UNREPORTED",
+				"PROOF_OF_CONCEPT",
+				"ATTACKED",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"ciaRequirementType": {
+			"type": "string",
+			"enum": [
+				"LOW",
+				"MEDIUM",
+				"HIGH",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"safetyType": {
+			"type": "string",
+			"enum": [
+				"NEGLIGIBLE",
+				"PRESENT",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"automatableType": {
+			"type": "string",
+			"enum": [
+				"NO",
+				"YES",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"recoveryType": {
+			"type": "string",
+			"enum": [
+				"AUTOMATIC",
+				"USER",
+				"IRRECOVERABLE",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"valueDensityType": {
+			"type": "string",
+			"enum": [
+				"DIFFUSE",
+				"CONCENTRATED",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"vulnerabilityResponseEffortType": {
+			"type": "string",
+			"enum": [
+				"LOW",
+				"MODERATE",
+				"HIGH",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"providerUrgencyType": {
+			"type": "string",
+			"enum": [
+				"CLEAR",
+				"GREEN",
+				"AMBER",
+				"RED",
+				"NOT_DEFINED"
+			],
+			"default": "NOT_DEFINED"
+		},
+		"scoreType": {
+			"type": "number",
+			"enum": [
+				0.0,
+				0.1,
+				0.2,
+				0.3,
+				0.4,
+				0.5,
+				0.6,
+				0.7,
+				0.8,
+				0.9,
+				1.0,
+				1.1,
+				1.2,
+				1.3,
+				1.4,
+				1.5,
+				1.6,
+				1.7,
+				1.8,
+				1.9,
+				2.0,
+				2.1,
+				2.2,
+				2.3,
+				2.4,
+				2.5,
+				2.6,
+				2.7,
+				2.8,
+				2.9,
+				3.0,
+				3.1,
+				3.2,
+				3.3,
+				3.4,
+				3.5,
+				3.6,
+				3.7,
+				3.8,
+				3.9,
+				4.0,
+				4.1,
+				4.2,
+				4.3,
+				4.4,
+				4.5,
+				4.6,
+				4.7,
+				4.8,
+				4.9,
+				5.0,
+				5.1,
+				5.2,
+				5.3,
+				5.4,
+				5.5,
+				5.6,
+				5.7,
+				5.8,
+				5.9,
+				6.0,
+				6.1,
+				6.2,
+				6.3,
+				6.4,
+				6.5,
+				6.6,
+				6.7,
+				6.8,
+				6.9,
+				7.0,
+				7.1,
+				7.2,
+				7.3,
+				7.4,
+				7.5,
+				7.6,
+				7.7,
+				7.8,
+				7.9,
+				8.0,
+				8.1,
+				8.2,
+				8.3,
+				8.4,
+				8.5,
+				8.6,
+				8.7,
+				8.8,
+				8.9,
+				9.0,
+				9.1,
+				9.2,
+				9.3,
+				9.4,
+				9.5,
+				9.6,
+				9.7,
+				9.8,
+				9.9,
+				10.0
+			]
+		},
+		"noneScoreType": {
+			"type": "number",
+			"minimum": 0,
+			"maximum": 0
+		},
+		"lowScoreType": {
+			"type": "number",
+			"enum": [
+				0.1,
+				0.2,
+				0.3,
+				0.4,
+				0.5,
+				0.6,
+				0.7,
+				0.8,
+				0.9,
+				1.0,
+				1.1,
+				1.2,
+				1.3,
+				1.4,
+				1.5,
+				1.6,
+				1.7,
+				1.8,
+				1.9,
+				2.0,
+				2.1,
+				2.2,
+				2.3,
+				2.4,
+				2.5,
+				2.6,
+				2.7,
+				2.8,
+				2.9,
+				3.0,
+				3.1,
+				3.2,
+				3.3,
+				3.4,
+				3.5,
+				3.6,
+				3.7,
+				3.8,
+				3.9
+			]
+		},
+		"mediumScoreType": {
+			"type": "number",
+			"enum": [
+				4.0,
+				4.1,
+				4.2,
+				4.3,
+				4.4,
+				4.5,
+				4.6,
+				4.7,
+				4.8,
+				4.9,
+				5.0,
+				5.1,
+				5.2,
+				5.3,
+				5.4,
+				5.5,
+				5.6,
+				5.7,
+				5.8,
+				5.9,
+				6.0,
+				6.1,
+				6.2,
+				6.3,
+				6.4,
+				6.5,
+				6.6,
+				6.7,
+				6.8,
+				6.9
+			]
+		},
+		"highScoreType": {
+			"type": "number",
+			"enum": [
+				7.0,
+				7.1,
+				7.2,
+				7.3,
+				7.4,
+				7.5,
+				7.6,
+				7.7,
+				7.8,
+				7.9,
+				8.0,
+				8.1,
+				8.2,
+				8.3,
+				8.4,
+				8.5,
+				8.6,
+				8.7,
+				8.8,
+				8.9
+			]
+		},
+		"criticalScoreType": {
+			"type": "number",
+			"enum": [
+				9.0,
+				9.1,
+				9.2,
+				9.3,
+				9.4,
+				9.5,
+				9.6,
+				9.7,
+				9.8,
+				9.9,
+				10.0
+			]
+		},
+		"severityType": {
+			"type": "string",
+			"enum": [
+				"NONE",
+				"LOW",
+				"MEDIUM",
+				"HIGH",
+				"CRITICAL"
+			]
+		},
+		"noneSeverityType": {
+			"const": "NONE"
+		},
+		"lowSeverityType": {
+			"const": "LOW"
+		},
+		"mediumSeverityType": {
+			"const": "MEDIUM"
+		},
+		"highSeverityType": {
+			"const": "HIGH"
+		},
+		"criticalSeverityType": {
+			"const": "CRITICAL"
+		}
+	},
+	"properties": {
+		"version": {
+			"description": "CVSS Version",
+			"type": "string",
+			"enum": [
+				"4.0"
+			]
+		},
+		"vectorString": {
+			"type": "string",
+			"pattern": "^CVSS:4[.]0/AV:[NALP]/AC:[LH]/AT:[NP]/PR:[NLH]/UI:[NPA]/VC:[HLN]/VI:[HLN]/VA:[HLN]/SC:[HLN]/SI:[HLN]/SA:[HLN](/E:[XAPU])?(/CR:[XHML])?(/IR:[XHML])?(/AR:[XHML])?(/MAV:[XNALP])?(/MAC:[XLH])?(/MAT:[XNP])?(/MPR:[XNLH])?(/MUI:[XNPA])?(/MVC:[XNLH])?(/MVI:[XNLH])?(/MVA:[XNLH])?(/MSC:[XNLH])?(/MSI:[XNLHS])?(/MSA:[XNLHS])?(/S:[XNP])?(/AU:[XNY])?(/R:[XAUI])?(/V:[XDC])?(/RE:[XLMH])?(/U:(X|Clear|Green|Amber|Red))?$"
+		},
+		"baseScore": {
+			"$ref": "#/definitions/scoreType"
+		},
+		"baseSeverity": {
+			"$ref": "#/definitions/severityType"
+		},
+		"attackVector": {
+			"$ref": "#/definitions/attackVectorType"
+		},
+		"attackComplexity": {
+			"$ref": "#/definitions/attackComplexityType"
+		},
+		"attackRequirements": {
+			"$ref": "#/definitions/attackRequirementsType"
+		},
+		"privilegesRequired": {
+			"$ref": "#/definitions/privilegesRequiredType"
+		},
+		"userInteraction": {
+			"$ref": "#/definitions/userInteractionType"
+		},
+		"vulnConfidentialityImpact": {
+			"$ref": "#/definitions/vulnCiaType"
+		},
+		"vulnIntegrityImpact": {
+			"$ref": "#/definitions/vulnCiaType"
+		},
+		"vulnAvailabilityImpact": {
+			"$ref": "#/definitions/vulnCiaType"
+		},
+		"subConfidentialityImpact": {
+			"$ref": "#/definitions/subCiaType"
+		},
+		"subIntegrityImpact": {
+			"$ref": "#/definitions/subCiaType"
+		},
+		"subAvailabilityImpact": {
+			"$ref": "#/definitions/subCiaType"
+		},
+		"exploitMaturity": {
+			"$ref": "#/definitions/exploitMaturityType"
+		},
+		"confidentialityRequirement": {
+			"$ref": "#/definitions/ciaRequirementType"
+		},
+		"integrityRequirement": {
+			"$ref": "#/definitions/ciaRequirementType"
+		},
+		"availabilityRequirement": {
+			"$ref": "#/definitions/ciaRequirementType"
+		},
+		"modifiedAttackVector": {
+			"$ref": "#/definitions/modifiedAttackVectorType"
+		},
+		"modifiedAttackComplexity": {
+			"$ref": "#/definitions/modifiedAttackComplexityType"
+		},
+		"modifiedAttackRequirements": {
+			"$ref": "#/definitions/modifiedAttackRequirementsType"
+		},
+		"modifiedPrivilegesRequired": {
+			"$ref": "#/definitions/modifiedPrivilegesRequiredType"
+		},
+		"modifiedUserInteraction": {
+			"$ref": "#/definitions/modifiedUserInteractionType"
+		},
+		"modifiedVulnConfidentialityImpact": {
+			"$ref": "#/definitions/modifiedVulnCiaType"
+		},
+		"modifiedVulnIntegrityImpact": {
+			"$ref": "#/definitions/modifiedVulnCiaType"
+		},
+		"modifiedVulnAvailabilityImpact": {
+			"$ref": "#/definitions/modifiedVulnCiaType"
+		},
+		"modifiedSubConfidentialityImpact": {
+			"$ref": "#/definitions/modifiedSubCType"
+		},
+		"modifiedSubIntegrityImpact": {
+			"$ref": "#/definitions/modifiedSubIaType"
+		},
+		"modifiedSubAvailabilityImpact": {
+			"$ref": "#/definitions/modifiedSubIaType"
+		},
+		"Safety": {
+			"$ref": "#/definitions/safetyType"
+		},
+		"Automatable": {
+			"$ref": "#/definitions/automatableType"
+		},
+		"Recovery": {
+			"$ref": "#/definitions/recoveryType"
+		},
+		"valueDensity": {
+			"$ref": "#/definitions/valueDensityType"
+		},
+		"vulnerabilityResponseEffort": {
+			"$ref": "#/definitions/vulnerabilityResponseEffortType"
+		},
+		"providerUrgency": {
+			"$ref": "#/definitions/providerUrgencyType"
+		}
+	},
+	"allOf": [
+		{
+			"anyOf": [
+				{
+					"properties": {
+						"baseScore": {
+							"$ref": "#/definitions/noneScoreType"
+						},
+						"baseSeverity": {
+							"$ref": "#/definitions/noneSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"baseScore": {
+							"$ref": "#/definitions/lowScoreType"
+						},
+						"baseSeverity": {
+							"$ref": "#/definitions/lowSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"baseScore": {
+							"$ref": "#/definitions/mediumScoreType"
+						},
+						"baseSeverity": {
+							"$ref": "#/definitions/mediumSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"baseScore": {
+							"$ref": "#/definitions/highScoreType"
+						},
+						"baseSeverity": {
+							"$ref": "#/definitions/highSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"baseScore": {
+							"$ref": "#/definitions/criticalScoreType"
+						},
+						"baseSeverity": {
+							"$ref": "#/definitions/criticalSeverityType"
+						}
+					}
+				}
+			]
+		},
+		{
+			"anyOf": [
+				{
+					"properties": {
+						"threatScore": {
+							"$ref": "#/definitions/noneScoreType"
+						},
+						"threatSeverity": {
+							"$ref": "#/definitions/noneSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"threatScore": {
+							"$ref": "#/definitions/lowScoreType"
+						},
+						"threatSeverity": {
+							"$ref": "#/definitions/lowSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"threatScore": {
+							"$ref": "#/definitions/mediumScoreType"
+						},
+						"threatSeverity": {
+							"$ref": "#/definitions/mediumSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"threatScore": {
+							"$ref": "#/definitions/highScoreType"
+						},
+						"threatSeverity": {
+							"$ref": "#/definitions/highSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"threatScore": {
+							"$ref": "#/definitions/criticalScoreType"
+						},
+						"threatSeverity": {
+							"$ref": "#/definitions/criticalSeverityType"
+						}
+					}
+				}
+			]
+		},
+		{
+			"anyOf": [
+				{
+					"properties": {
+						"environmentalScore": {
+							"$ref": "#/definitions/noneScoreType"
+						},
+						"environmentalSeverity": {
+							"$ref": "#/definitions/noneSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"environmentalScore": {
+							"$ref": "#/definitions/lowScoreType"
+						},
+						"environmentalSeverity": {
+							"$ref": "#/definitions/lowSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"environmentalScore": {
+							"$ref": "#/definitions/mediumScoreType"
+						},
+						"environmentalSeverity": {
+							"$ref": "#/definitions/mediumSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"environmentalScore": {
+							"$ref": "#/definitions/highScoreType"
+						},
+						"environmentalSeverity": {
+							"$ref": "#/definitions/highSeverityType"
+						}
+					}
+				},
+				{
+					"properties": {
+						"environmentalScore": {
+							"$ref": "#/definitions/criticalScoreType"
+						},
+						"environmentalSeverity": {
+							"$ref": "#/definitions/criticalSeverityType"
+						}
+					}
+				}
+			]
+		}
+	],
+	"required": [
+		"version",
+		"vectorString",
+		"baseScore",
+		"baseSeverity"
+	],
+	"additionalProperties": false
+}