cvss-to-3.1

A small Ruby gem that normalizes CVSS vectors from mixed versions into a CVSS 3.1 object.

It accepts CVSS 2.0, 3.0, 3.1, and 4.0 input and returns a scored CvssSuite::Cvss31 object so downstream systems can compare and store values in one format.

Add this line to your application's Gemfile:

gem 'cvss-to-3.1'

Then run:

bundle install

Or install directly:

gem install cvss-to-3.1

require 'cvss_to_31'

result = CvssTo31.convert('CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H')

result.version.to_s # => "3.1"
result.vector       # => "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
result.base_score   # => 10.0

The API accepts either a vector string or a CvssSuite object:

v2 = CvssSuite.new('AV:N/AC:L/Au:N/C:C/I:C/A:C')
CvssTo31.convert(v2)

Passthrough. A valid 3.1 vector/object is returned unchanged.

Lossless version re-stamp (CVSS:3.0 -> CVSS:3.1) with metrics preserved.

CVSS 2.0 lacks some fields required by 3.1, so this conversion is approximate.

CVSS 4.0 includes metrics not present in 3.1 and vice versa. The gem applies the following normalization:

CvssTo31.convert raises:

• CvssTo31::Error for invalid vectors
• CvssTo31::UnsupportedVersionError for unsupported CVSS versions

Run tests:

bundle exec rspec

Build the gem:

gem build cvss-to-3.1.gemspec

Licensed under the BSD 2-Clause License. See LICENSE.