stevespringett / cvss-calculator

A Java library for calculating CVSSv2, CVSSv3, and CVSSv4 scores and vectors

CVSS Calculator

CVSS Calculator is a Java library for calculating CVSSv2, CVSSv3, and CVSSv3.1 scores and vectors, including support for base scores, impact scores, and exploitability scores.

Compiling

$ mvn clean package

Usage Example

// Performs a new calculation using CVSSv3
CvssV3 cvssV3 = new CvssV3()
    .attackVector(AttackVector.NETWORK)
    .attackComplexity(AttackComplexity.LOW)
    .privilegesRequired(PrivilegesRequired.HIGH)
    .userInteraction(UserInteraction.NONE)
    .scope(Scope.UNCHANGED)
    .confidentiality(CIA.HIGH)
    .integrity(CIA.HIGH)
    .availability(CIA.HIGH);

Score score = cvssV3.calculateScore();

// Parses an existing CVSS v2 or v3 vector
Cvss cvss = Cvss.fromVector(vector);
Score score = cvss.calculateScore();

Maven Usage

CVSS Calculator is available in the Maven Central Repository.

<dependency>
    <groupId>us.springett</groupId>
    <artifactId>cvss-calculator</artifactId>
    <version>1.4.2</version>
</dependency>

Copyright & License

CVSS Calculator is Copyright (c) Steve Springett. All Rights Reserved.

All other trademarks are property of their respective owners.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.

cvss-calculator's Issues

CVSS:3.1 vectors may get parsed to CVSS:3.0 instance

I've ran Cvss.parse(..) against a couple of vectors, e.g. "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H".
The implementation matches it as 3.0 string, so Cvss.parse(..).toVector() return vectors of the form "CVSS:3.1/*".

Missing default CVSS metric values would result in incorrect score (-1.0)

Hello,

If a vector string did not set metric values in Temporal or Environmental metric groups, the resulting score is "-1.0".

String vectorWithMissingTemporal = "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:F";
Cvss cvss = Cvss.fromVector(vectorWithMissingTemporal);
Score score = cvss.calculateScore();
System.out.println(score.getBaseScore()); // 7.6
System.out.println(score.getTemporalScore()); // -1.0 (should be 7.4)
System.out.println(score.getEnvironmentalScore()); // -1.0 (should be 7.4)

Reference:
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:F

CVSS v3.0 and v3.1

Let's start by saying that if any of my assumptions is wrong this issue is not relevant.

As far as I know CVSS vectors of version 3.0 and 3.1 are identical at least in the definition of the vector. However the library is splitting them based on the lack of environmental metrics in the vector. If I'm not wrong a CVSS 3.0 could have environmental metrics or a CVSS 3.1 vector could have only the base vector.

The effect in the library is that if we try to serialize the vector we will get a definition that starts with CVSS:3.0 or CVSS:3.1 depending on the environmental metrics which I think is wrong. Wouldn't it be more natural to have:

• A single CVSS3 class
• That keeps the original specification and dumps it in getVector() method accordingly
• That runs one algorithm or the other in calculateScore() depending on the presence or not of the environmental metrics

If it make sense I could even try to create a PR based on that if needed

CVSS V4.0

Hi,
Are you planning to support cvss v4.0.
If so, what is the estimated time for the support?

Best,
Tom

CVSS pattern only matches specific metric order

Hi @stevespringett

I have come across an issue with the CVSS vector: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N (fetched from the CVEProject and hence not under my control).
Parsing it results in a null result from Cvss.fromVector as the V3_PATTERN doesn't match the - admittely rather unusual - order of this vector string.
FIRST's CVSS schema is more relaxed here and sees this order as valid.
From what I can see in the code, this would affect all vector strings that are not in the "usual" order.

CVSS vector string with Environmental metric group is not supported

Hello,

The official CVSS v3.0 specification includes Environmental metric group, while the library does not support that.

Example code:

String vectorWithEnvMetric = "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:R/CR:L/IR:M/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:N";
Cvss cvss = Cvss.fromVector(vectorWithEnvMetric);
Score score = cvss.calculateScore();
System.out.println(score.getEnvironmentalScore()); // 0.0 (should be 5.8)

Reference:
https://www.first.org/cvss/v3.0/specification-document#Environmental-Metrics

Expected result using the official CVSS calculator:
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:R/CR:L/IR:M/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:L/MI:L/MA:L