aboutcode-org / vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/
https://public.vulnerablecode.io
Apache License 2.0
529 stars 199 forks source link

Display CVSS vectors and allow their search #1239

Open TG1999 opened 1 year ago

TG1999 commented 1 year ago

We currently do not display CVSS vectors in the vulnerability details view and do not allow the the capability to search by a CVSS vector

ziadhany commented 1 year ago

I think using this may be a good start

>>> from cvss import CVSS3
>>> v = CVSS3("CVSS:3.0/AV:L/UI:N/AC:L/PR:H/C:N/I:L/A:H/S:C/E:U/RL:W/RC:X")
>>> v.as_json()
{'version': '3.0',
 'vectorString': 'CVSS:3.0/AV:L/UI:N/AC:L/PR:H/C:N/I:L/A:H/S:C/E:U/RL:W/RC:X',
 'attackVector': 'LOCAL',
 'attackComplexity': 'LOW',
 'privilegesRequired': 'HIGH',
 'userInteraction': 'NONE',
 'scope': 'CHANGED',
 'confidentialityImpact': 'NONE',
 'integrityImpact': 'LOW',
 'availabilityImpact': 'HIGH',
 'baseScore': 6.7,
 'baseSeverity': 'MEDIUM',
 'exploitCodeMaturity': 'UNPROVEN',
 'remediationLevel': 'WORKAROUND',
 'reportConfidence': 'NOT_DEFINED',
 'temporalScore': 6.0,
 'temporalSeverity': 'MEDIUM',
 'confidentialityRequirement': 'NOT_DEFINED',
 'integrityRequirement': 'NOT_DEFINED',
 'availabilityRequirement': 'NOT_DEFINED',
 'modifiedAttackVector': 'LOCAL',
 'modifiedAttackComplexity': 'LOW',
 'modifiedPrivilegesRequired': 'HIGH',
 'modifiedUserInteraction': 'NONE',
 'modifiedConfidentialityImpact': 'NONE',
 'modifiedIntegrityImpact': 'LOW',
 'modifiedAvailabilityImpact': 'HIGH',
 'environmentalScore': 6.0,
 'environmentalSeverity': 'MEDIUM'}