aboutcode-org / aboutcode-org/vulnerablecode

Wrong CVSS3 V3.1 QR "MODERATE"

Open
#1,186 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
702
Forks
328
Avg merge
3d 8h
Merged PRs (30d)
3

Description

GitHub advisories provide the severity "MODERATE" and as a result VulnerableCode does also provide this severity which according to the [specification](https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale) should be "MEDIUM" instead.

For example, this severity is classified as "MODERATE" by GitHub:
https://github.com/advisories/GHSA-c7mc-q43h-5672

It is reported by VulnerableCode as:
```json
{
"reference_url": "https://github.com/advisories/GHSA-c7mc-q43h-5672",
"reference_id": "GHSA-c7mc-q43h-5672",
"scores": [
{
"value": "MODERATE",
"scoring_system": "cvssv3.1_qr",
"scoring_elements": ""
}
],
"url": "https://github.com/advisories/GHSA-c7mc-q43h-5672"
}
```

It would be good if VulnerableCode could map "MODERATE" to the correct "MEDIUM" in its API response.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.