facebookincubator/nvdtools

Invalid CVSS v2 environmental score computation

pandatix opened this issue · 0 comments

Still while fuzzing the implementation, I discovered that environmental scores were not computed properly, leading to invalid scores.
For instance, the following Go code computes the three scores and prints them.

package main

import (
	"fmt"

	"github.com/facebookincubator/nvdtools/cvss2"
)

func main() {
	vec, _ := cvss2.VectorFromString("AV:A/AC:L/Au:N/C:C/I:C/A:C/CDP:H/TD:H/CR:M/IR:L/AR:M")

	b, t, e := vec.BaseScore(), vec.TemporalScore(), vec.EnvironmentalScore()
	fmt.Printf("Scores: %.1f;%.1f;%.1f\n", b, t, e)
}

produces ->

Scores: 8.3;8.3;9.1

You can check this input is valid using the NVD calculator but then computes an environmental score of 9.1 (should be 9.0).