Skip to content
This repository has been archived by the owner on Dec 1, 2024. It is now read-only.

Invalid CVSS v2 environmental score computation #204

Open
pandatix opened this issue Jan 28, 2023 · 0 comments
Open

Invalid CVSS v2 environmental score computation #204

pandatix opened this issue Jan 28, 2023 · 0 comments

Comments

@pandatix
Copy link

Still while fuzzing the implementation, I discovered that environmental scores were not computed properly, leading to invalid scores.
For instance, the following Go code computes the three scores and prints them.

package main

import (
	"fmt"

	"github.com/facebookincubator/nvdtools/cvss2"
)

func main() {
	vec, _ := cvss2.VectorFromString("AV:A/AC:L/Au:N/C:C/I:C/A:C/CDP:H/TD:H/CR:M/IR:L/AR:M")

	b, t, e := vec.BaseScore(), vec.TemporalScore(), vec.EnvironmentalScore()
	fmt.Printf("Scores: %.1f;%.1f;%.1f\n", b, t, e)
}

produces ->

Scores: 8.3;8.3;9.1

You can check this input is valid using the NVD calculator but then computes an environmental score of 9.1 (should be 9.0).

# for free to subscribe to this conversation on GitHub. Already have an account? #.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant