cvss_v4 (cvss v0.1.1)

View Source

CVSS 4.0 parsing, composition, validation, and scoring.

Use this module when working with CVSS 4.0 vectors directly. If the version is not known ahead of time, use cvss instead.

Vector format: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

See: https://www.first.org/cvss/v4.0/specification-document

Summary

Types

ac()
at()
automatable()
av()
cia()
cvss()
exploit_maturity()
pr()
recovery()
requirement()
response_effort()
safety()
si_sa()
ui()
urgency()
value_density()

Functions

base_score/1

Calculate the CVSS 4.0 Base Score (CVSS-B). Only considers base metrics; threat and environmental metrics are ignored.

compose/1

Compose a CVSS 4.0 record into a vector string.

environmental_score/1

Calculate the CVSS 4.0 Environmental Score (CVSS-BE). Considers base and environmental metrics; threat metrics are ignored.

parse(Vector)

Parse a CVSS 4.0 vector string.

score/1

Calculate the CVSS 4.0 score (CVSS-BTE). Uses all present metrics (Base + Threat + Environmental). Metrics not explicitly set default per the CVSS 4.0 specification.

threat_score/1

Calculate the CVSS 4.0 Threat Score (CVSS-BT). Considers base and threat metrics; environmental metrics are ignored.

valid/1

Check whether a CVSS 4.0 value is valid.

Types

ac()

-type ac() :: low | high.

at()

-type at() :: none | present.

automatable()

-type automatable() :: no | yes.

av()

-type av() :: network | adjacent | local | physical.

cia()

-type cia() :: none | low | high.

cvss()

-type cvss() ::
          #cvss_v4{av :: cvss_v4:av(),
                   ac :: cvss_v4:ac(),
                   at :: cvss_v4:at(),
                   pr :: cvss_v4:pr(),
                   ui :: cvss_v4:ui(),
                   vc :: cvss_v4:cia(),
                   vi :: cvss_v4:cia(),
                   va :: cvss_v4:cia(),
                   sc :: cvss_v4:cia(),
                   si :: cvss_v4:si_sa(),
                   sa :: cvss_v4:si_sa(),
                   e :: cvss_v4:exploit_maturity() | undefined,
                   cr :: cvss_v4:requirement() | undefined,
                   ir :: cvss_v4:requirement() | undefined,
                   ar :: cvss_v4:requirement() | undefined,
                   mav :: cvss_v4:av() | undefined,
                   mac :: cvss_v4:ac() | undefined,
                   mat :: cvss_v4:at() | undefined,
                   mpr :: cvss_v4:pr() | undefined,
                   mui :: cvss_v4:ui() | undefined,
                   mvc :: cvss_v4:cia() | undefined,
                   mvi :: cvss_v4:cia() | undefined,
                   mva :: cvss_v4:cia() | undefined,
                   msc :: cvss_v4:cia() | undefined,
                   msi :: cvss_v4:si_sa() | undefined,
                   msa :: cvss_v4:si_sa() | undefined,
                   safety :: cvss_v4:safety() | undefined,
                   automatable :: cvss_v4:automatable() | undefined,
                   recovery :: cvss_v4:recovery() | undefined,
                   value_density :: cvss_v4:value_density() | undefined,
                   response_effort :: cvss_v4:response_effort() | undefined,
                   urgency :: cvss_v4:urgency() | undefined}.

exploit_maturity()

-type exploit_maturity() :: attacked | poc | unreported | not_defined.

pr()

-type pr() :: none | low | high.

recovery()

-type recovery() :: automatic | user | irrecoverable.

requirement()

-type requirement() :: low | medium | high | not_defined.

response_effort()

-type response_effort() :: low | moderate | high.

safety()

-type safety() :: negligible | present.

si_sa()

-type si_sa() :: none | low | high | safety.

ui()

-type ui() :: none | passive | active.

urgency()

-type urgency() :: clear | green | amber | red.

value_density()

-type value_density() :: diffuse | concentrated.

Functions

base_score/1

-spec base_score(cvss_v4:cvss()) -> cvss:score().

Calculate the CVSS 4.0 Base Score (CVSS-B). Only considers base metrics; threat and environmental metrics are ignored.

> {ok, Cvss} = cvss_v4:parse(<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">>).
> cvss_v4:base_score(Cvss).
10.0

compose/1

-spec compose(cvss_v4:cvss()) -> iolist().

Compose a CVSS 4.0 record into a vector string.

> iolist_to_binary(cvss_v4:compose(#cvss_v4{av = network, ac = low, at = none,
                                           pr = none, ui = none,
                                           vc = high, vi = high, va = high,
                                           sc = high, si = high, sa = high})).
<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">>

environmental_score/1

-spec environmental_score(cvss_v4:cvss()) -> cvss:score().

Calculate the CVSS 4.0 Environmental Score (CVSS-BE). Considers base and environmental metrics; threat metrics are ignored.

> {ok, Cvss} = cvss_v4:parse(<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/MVC:N/MVI:N/MVA:N/MSC:N/MSI:N/MSA:N">>).
> cvss_v4:environmental_score(Cvss).
0.0

parse(Vector)

-spec parse(binary()) -> {ok, cvss_v4:cvss()} | {error, cvss:parse_error()}.

Parse a CVSS 4.0 vector string.

> cvss_v4:parse(<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">>).
{ok, #cvss_v4{av = network, ac = low, at = none, pr = none, ui = none,
              vc = high, vi = high, va = high, sc = high, si = high, sa = high}}

> cvss_v4:parse(<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A">>).
{ok, #cvss_v4{av = network, ac = low, at = none, pr = none, ui = none,
              vc = high, vi = high, va = high, sc = high, si = high, sa = high,
              e = attacked}}

> cvss_v4:parse(<<"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:S/SA:S">>).
{ok, #cvss_v4{av = physical, ac = low, at = none, pr = none, ui = none,
              vc = high, vi = high, va = high, sc = high, si = safety, sa = safety}}

> cvss_v4:parse(<<"CVSS:4.0/AV:N">>).
{error, {missing_required_metric, ac}}

score/1

-spec score(cvss_v4:cvss()) -> cvss:score().

Calculate the CVSS 4.0 score (CVSS-BTE). Uses all present metrics (Base + Threat + Environmental). Metrics not explicitly set default per the CVSS 4.0 specification.

> {ok, Cvss} = cvss_v4:parse(<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">>).
> cvss_v4:score(Cvss).
10.0

> {ok, Cvss2} = cvss_v4:parse(<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N">>).
> cvss_v4:score(Cvss2).
0.0

threat_score/1

-spec threat_score(cvss_v4:cvss()) -> cvss:score().

Calculate the CVSS 4.0 Threat Score (CVSS-BT). Considers base and threat metrics; environmental metrics are ignored.

> {ok, Cvss} = cvss_v4:parse(<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A">>).
> cvss_v4:threat_score(Cvss).
10.0

valid/1

-spec valid(iodata() | cvss_v4:cvss()) -> boolean().

Check whether a CVSS 4.0 value is valid.

Accepts either a vector string or a parsed record.

> cvss_v4:valid(<<"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">>).
true

> cvss_v4:valid(#cvss_v4{av = network, ac = low, at = none, pr = none, ui = none,
                         vc = high, vi = high, va = high,
                         sc = high, si = high, sa = high}).
true

> cvss_v4:valid(<<"CVSS:4.0/AV:X">>).
false