FIRSTdotorg / FIRSTdotorg/cvss-resources
Score Question
- Dominant language
- JavaScript
- Stars
- 12
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
Hi team,
I don't think it's an issue but I'm facing a situation that I need your help to understand, I'm trying to score the vector:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` >>> https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
It's returning the **8.7** score and Macro vector: **001200** but checking the cvss_lookup.js I do see **8.8** score for this macro, and checking the resources in this repo [https://github.com/FIRSTdotorg/cvss-resources/blob/main/vectorFiles/base-threat-scores](url) I see **8.7** (E:X and E:A). Can you please tell me which one is correct? Should I consider only the scores listed in base-threat-scores? Thank you
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with cvss_lookup.js and compare the reported 8.8 macro score against the linked base-threat-scores resources for macro vector 001200. Reproduce the vector in the FIRST calculator, then determine which source is authoritative and document why the E:X and E:A values differ, if applicable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100