search

RedHatProductSecurity / cvss-v4-calculator

CVSS v4.0 calculator
https://redhatproductsecurity.github.io/cvss-v4-calculator/
BSD 2-Clause "Simplified" License
32 stars 22 forks source link

The Value and Key for 'Not Defined' Option in CR_levels, IR_levels and AR_levels is missing #45

Closed suddmishra25 closed 9 months ago

suddmishra25 commented 9 months ago

When value of Confidentiality Requirements (CR), Integrity Requirements (IR) and Availability Requirements (AR) are 'Not Defined(X)' then on this line of code - severity_distance_CR = CR_levels[this.m("CR")] - CR_levels[this.extractValueMetric("CR", max_vector)] CR_levels[X] does not exists in CR_levels = { 'H': 0.0, 'M': 0.1, 'L': 0.2 }. Similarly it happening for IR and AR.

skontar commented 9 months ago

@pandatix , can you please check this fix?

pandatix commented 9 months ago

The issue described here does not affect computation as the values are pre-processed by the helper m here. When extracting the value of "CR" (or other similar ones), if the value is "X" it is given its corresponding lower one i.e. "H" is this case.

This could be an issue if you are trying to copy the calculator internals (please check the license then). The FIRST.ORG requested the community to provide a JS library, but none has emerged yet (reason under why the calculator has been built this way).