Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Severity calculators supplemental elements do not change score #542

Closed
felix-caboff opened this issue Oct 14, 2024 · 2 comments
Closed

Severity calculators supplemental elements do not change score #542

felix-caboff opened this issue Oct 14, 2024 · 2 comments
Assignees
Labels
bug Something isn't working

Comments

@felix-caboff
Copy link

Describe the bug
The two CVSS calculators work well, however, the score only changes when the base score is updated. The CVSS vector updates, but, not the score itself and therefore the qualitative severity rating do not.

This vector for example:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

has a 5.3 rating. But this vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:U/CR:L/IR:L/AR:L/MAV:P/MAC:H/MPR:H/MUI:R/MS:C/MC:H/MI:H/MA:H

Also has a 5.3 rating and it should be a 4.2. For clarity this also does not change the qualitative severity rating when crossing a boundry say Medium -> Low.

To Reproduce
Steps to reproduce the behavior:

  1. In a finding open the calculator slider
  2. Either select values from the calculator or paste in the vector from above.
  3. Change the values of any quality that is not in the "base" section.
  4. Observe the vector changing in all situations
  5. Observe the score not changing except when updating the base section.

Expected Behavior
All areas of the calculator should update the score and qualitative severity rating

Server Specs:
v4.3.2, released 30 September 2024

@felix-caboff felix-caboff added the bug Something isn't working label Oct 14, 2024
@domwhewell-sage
Copy link
Contributor

I think this is a duplicate of #536 I have opened a PR to fix that here #537 pending approval

@felix-caboff
Copy link
Author

Ah cheers @domwhewell-sage I hadn't spotted the other issue, but also aware that the CVSS calc stuff has changed significantly since. 🤷 Thanks for joining the two together though - I will close this and comment on the one you have linked.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants