Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added CVSS Environmental metrics #345

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Conversation

Iorpim
Copy link

@Iorpim Iorpim commented Oct 2, 2023

Issue

#232

Description of the Change

This PR adds support for CVSS 3.0 Environmental metrics to the CVSS calculator.
The bulk of the changes are purely the addition of a new form and part of the JavaScript to handle it, with the exception of the change to the Finding model, increasing the length of the cvss_vector field to fit the new increased vector with additional metrics.
The Environmental calculator was added only when editing a finding inside a report as it's supposed to be a more case-by-case metric and not intrinsic to the vulnerability.
Temporal metrics were also omitted due to their smaller relevance for pentest reporting. However, implementation is trivial if required.
One possible future improvement is adding a new field in the Finding model, storing the Base and Environmental scores separately so they can both be laid out in reports.

Alternate Designs

N/A

Possible Drawbacks

The only downside is making the calculator a little more full, another reason the less relevant Temporal metrics were excluded in this change. The calculator can be easily collapsed, however.

Verification Process

The changes are almost purely front-end and very granular so changes were manually tested, scores were compared to the NIST calculator, and new findings were created and edited with and without environmental metrics.

Release Notes

  • Added CVSS 3.0 Environmental metrics to the CVSS calculator

@Iorpim
Copy link
Author

Iorpim commented Oct 2, 2023

One additional note is that the previous linting configurations are deprecated in newer versions of VS Code, so the external dependencies were migrated to the official recommended extensions instead, and added to the extensions.json file for easier setup.

A side effect is that longer lines were automatically split up into multiple line statements by the linter. If this is undesired, changes can be cherrypicked without affecting the PR functionality, however, deprecation of external linters should be noted in that case.

@chrismaddalena
Copy link
Collaborator

Thanks for submitting this! I will take a look at it soon. I will try to look at it before I leave on a trip, but it may be toward the end of the month if not.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants