neuralegion/cvss

The Common Vulnerability Scoring System (CVSS) base score calculator and validator library written in TypeScript.

cvss's Issues

Environmental score error with CVSS 3.0

Hi !

There is a score error when computing the environmental score of a CVSS 3.0 vector string :

Take this example code :

const cvss = require('@neuralegion/cvss');

console.log("Base : " + cvss.calculateBaseScore('CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'));
console.log("Environmental : ", cvss.calculateEnvironmentalResult('CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'));

The base score that is printed is 9.6 as expected but the environmental score is printed as 9.9 :

Base : 9.6
Environmental :  {
  score: 9.9,
  metricsMap: Map(22) {
    'AV' => 'A',
    'AC' => 'L',
    'PR' => 'N',
    'UI' => 'N',
    'S' => 'C',
    'C' => 'H',
    'I' => 'H',
    'A' => 'H',
    'E' => 'X',
    'RL' => 'X',
    'RC' => 'X',
    'AR' => 'X',
    'CR' => 'X',
    'IR' => 'X',
    'MAV' => 'A',
    'MAC' => 'L',
    'MPR' => 'N',
    'MUI' => 'N',
    'MS' => 'C',
    'MC' => 'H',
    'MI' => 'H',
    'MA' => 'H'
  },
  impact: 6.3,
  exploitability: 2.9
}

If we take the calculator from first.org (https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the environmental score should have been 9.6 as well.

Thank you