Merge pull request #35 from goark/debug-and-refactoring

Adjusted calculation error of CVSSv2 Base score (issue #33)
goark · Feb 4, 2023 · 9e847ca · 9e847ca
2 parents 0f78497 + ee5badc
commit 9e847ca
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 3 deletions.
diff --git a/v2/metric/base.go b/v2/metric/base.go
@@ -168,15 +168,15 @@ func (m *Base) Score() float64 {
 	if err := m.GetError(); err != nil {
 		return 0
 	}
-	impact := 10.41 * (1 - (1-m.C.Value())*(1-m.I.Value())*(1-m.A.Value()))
+	impact := roundTo2Decimal(10.41 * (1 - (1-m.C.Value())*(1-m.I.Value())*(1-m.A.Value())))
 	return m.score(impact)
 }
 
 func (m *Base) score(impact float64) float64 {
 	if err := m.GetError(); err != nil {
 		return 0
 	}
-	exploitability := 20 * m.AV.Value() * m.AC.Value() * m.Au.Value()
+	exploitability := roundTo2Decimal(20 * m.AV.Value() * m.AC.Value() * m.Au.Value())
 	fimpact := 1.176
 	if impact == 0 {
 		fimpact = 0

diff --git a/v2/metric/environmental.go b/v2/metric/environmental.go
@@ -183,7 +183,7 @@ func (m *Environmental) Score() float64 {
 	if m.IsEmpty() {
 		baseScore = m.Base.Score()
 	} else {
-		adjustedImpact := math.Min(10.0, roundTo1Decimal(10.41*(1-(1-m.C.Value()*m.CR.Value())*(1-m.I.Value()*m.IR.Value())*(1-m.A.Value()*m.AR.Value()))))
+		adjustedImpact := math.Min(10.0, roundTo2Decimal(10.41*(1-(1-m.C.Value()*m.CR.Value())*(1-m.I.Value()*m.IR.Value())*(1-m.A.Value()*m.AR.Value()))))
 		baseScore = m.Base.score(adjustedImpact)
 	}
 	var adjustedTemporal float64

diff --git a/v2/metric/metric_test.go b/v2/metric/metric_test.go
@@ -255,6 +255,13 @@ func TestEnvEnvironmentalScore(t *testing.T) {
 			temp:   8.3,
 			env:    9.0,
 		},
+		{
+			name:   "issue-33c",
+			vector: "AV:L/AC:M/Au:S/C:N/I:N/A:P/CDP:N/TD:ND/CR:M/IR:ND/AR:ND",
+			base:   1.5,
+			temp:   1.5,
+			env:    1.5,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

diff --git a/v2/metric/misc.go b/v2/metric/misc.go
@@ -6,6 +6,10 @@ func roundTo1Decimal(input float64) float64 {
 	return math.Round(input*10) / 10
 }
 
+func roundTo2Decimal(input float64) float64 {
+	return math.Round(input*100) / 100
+}
+
 /* Copyright 2023 Spiegel
  *
  * Licensed under the Apache License, Version 2.0 (the "License");