Invalid CVSS v2 environmental score computation
pandatix opened this issue · 0 comments
pandatix commented
Still while fuzzing the implementation, I discovered that environmental scores were not computed properly, leading to invalid scores.
For instance, the following Go code computes the three scores and prints them.
package main
import (
"fmt"
"github.com/facebookincubator/nvdtools/cvss2"
)
func main() {
vec, _ := cvss2.VectorFromString("AV:A/AC:L/Au:N/C:C/I:C/A:C/CDP:H/TD:H/CR:M/IR:L/AR:M")
b, t, e := vec.BaseScore(), vec.TemporalScore(), vec.EnvironmentalScore()
fmt.Printf("Scores: %.1f;%.1f;%.1f\n", b, t, e)
}
produces ->
Scores: 8.3;8.3;9.1
You can check this input is valid using the NVD calculator but then computes an environmental score of 9.1 (should be 9.0).