search

GhostManager / Ghostwriter

The SpecterOps project management and reporting engine
https://ghostwriter.wiki
BSD 3-Clause "New" or "Revised" License
1.23k stars 174 forks source link

Add CVSSv4 Calculator #387

Open domwhewell-sage opened 5 months ago

domwhewell-sage commented 5 months ago

Working PR to add CVSSv4 calculator onto the findings views as requested in #356.

The CVSSv4 calculator should appear as a optional tab once you click the "CVSS Calculator" accordion. So as to minimize changes in future all Metrics are included.

domwhewell-sage commented 5 months ago

The calculator at https://www.first.org/cvss/calculator/4.0 is slightly different to previous cvss versions in that it is being distributed as a vue.js application. https://github.com/FIRSTdotorg/cvss-v4-calculator

To avoid in inaccurate calculations by converting the vue.js app to javascript and mirror the existing cvss-v3 calculator it might make sense to fork the github project into the /static folder and display it within an iframe (Like first.org is doing). The only custom code will be extracting the final score and vector from the iframe and placing them into the cvss_score and cvss_vector fields.

felix-caboff commented 2 months ago

Hi Team,

Is there anything I can do to move this particular pull request along? Not sure what your process is, whether you need someone to do some testing or similar. (We are desperate for it, don't worry if you have a plan, just trying to be helpful)

It looks like the CodeFactor checks failed because of the third-party library. I would suggest that these failures are ignored as that code is not a GW specific element.

Thanks!

chrismaddalena commented 2 months ago

@felix-caboff Once we wrap-up some features that have been in-flight for v4.1, we'll take a look at this. The big question is how easy it is for someone to choose the calculator they want to use. Some people still want CVSS v3. Others are asking for CVSS v3.1. Another group wants CVSS v4. The ideal end state is they're all available and you can pick which one to use.

In the meantime, checking out this PR and providing feedback is very helpful.