FIRSTdotorg / FIRSTdotorg/cvss-resources

Score Question

Open
#1 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
12
Forks
2
PR merge metrics
No merged PRs in 30d

Description

Hi team,

I don't think it's an issue but I'm facing a situation that I need your help to understand, I'm trying to score the vector:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` >>> https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

It's returning the **8.7** score and Macro vector: **001200** but checking the cvss_lookup.js I do see **8.8** score for this macro, and checking the resources in this repo [https://github.com/FIRSTdotorg/cvss-resources/blob/main/vectorFiles/base-threat-scores](url) I see **8.7** (E:X and E:A). Can you please tell me which one is correct? Should I consider only the scores listed in base-threat-scores? Thank you

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with cvss_lookup.js and compare the reported 8.8 macro score against the linked base-threat-scores resources for macro vector 001200. Reproduce the vector in the FIRST calculator, then determine which source is authoritative and document why the E:X and E:A values differ, if applicable.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.