Welcome to Quant

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• package.json
• src/components/CVSSVersionsTabs.tsx
• src/components/FAQAccordion.tsx
• src/components/ScoreHistory.tsx
• src/lib/cvss/metrics-data.ts
• src/lib/cvss/types.ts
• src/lib/cvss/v2/scoring.ts
• src/lib/cvss/v3/scoring.ts
• src/lib/cvss/v4/scoring.ts

Quant is an intuitive, modern CVSS (Common Vulnerability Scoring System) score calculator designed to make vulnerability severity assessment fast, accurate, and accessible. It provides an interactive, client-side experience with real-time scoring, color-coded severity indicators, and advanced analytics. The entire application runs in the browser, ensuring user privacy as no data is ever sent to a server.

Built using Astro, React, and TypeScript, Quant offers a user-friendly interface for security professionals, developers, and organizations to quantify the risk of vulnerabilities. It supports multiple CVSS versions, including the latest CVSS v4.0 standard, and provides features for managing, comparing, and exporting assessment results.

Sources: README.md:11-14, src/components/FAQAccordion.tsx:31-34, package.json

Core Features

Quant provides a comprehensive set of features to streamline vulnerability assessment workflows.

Feature	Description
Multi-Version CVSS Support	Full support for scoring using CVSS v4.0, v3.1, v3.0, and v2.0.
Intelligent Severity Visualization	Color-coded risk levels, dynamic severity mapping, and visual impact charts for instant understanding.
Advanced Metric Control	Interactive controls for all CVSS metrics with in-context help and real-time score recalculation.
One-Click Export & Sharing	Functionality to copy vector strings, generate shareable links, and save scores to the Score Manager.
Score Analytics & Insights	Tools to visualize score distributions, analyze metric impact, and compare scores across different versions.
Privacy & Security	All calculations are performed client-side. No accounts are required, and no data is collected.
Developer Experience	The scoring logic is available as pure JavaScript functions with TypeScript support, making it embeddable in other projects.

Sources: README.md:25-87

Architecture and Technology Stack

Quant is a client-side single-page application. All logic, including the complex CVSS calculations, is executed entirely within the user's browser using JavaScript and TypeScript. This design choice prioritizes privacy and enables full offline functionality.

Sources: README.md:79-81, src/components/FAQAccordion.tsx:31-34, 137-140

This diagram shows the high-level architecture of the Quant application.

The project is built with a modern web technology stack:

• Framework: Astro
• UI Library: React
• Language: TypeScript
• Styling: Tailwind CSS
• UI Components: Radix UI & shadcn/ui
• Charting: Recharts

Sources: package.json:10-33, README.md:5

CVSS Scoring Engine

The core of Quant is a powerful, framework-agnostic scoring engine written in pure TypeScript. It implements the official specifications for multiple CVSS versions, ensuring accuracy and compliance with industry standards.

Sources: README.md:16, 83-84

Multi-Version Support

Quant supports the following CVSS versions, which can be selected via tabs in the user interface.

Version	Release Date	Key Characteristics
CVSS v4.0	Nov 2023	The latest standard. Introduces MacroVector-based scoring, separate metrics for subsequent system impact (e.g., SC, SI, SA), and enhanced supplemental metrics like Safety (S) and Automatable (AU).
CVSS v3.1	Jun 2019	The current industry standard. Refines v3.0, introducing the Scope (S) concept to distinguish impacts within or beyond the vulnerable component.
CVSS v3.0	Jun 2015	A major update from v2.0 that introduced the Scope concept and simplified metrics.
CVSS v2.0	Feb 2007	The legacy standard. Uses metrics like Access Vector (AV), Access Complexity (AC), and Authentication (Au).

Sources: src/components/CVSSVersionsTabs.tsx:17-270

Scoring Logic

Each CVSS version has a dedicated scoring module that implements its specific algorithm. The general flow involves taking a set of metric values as input and producing a detailed score object.

This flowchart illustrates the general process of calculating a CVSS score in Quant.

CVSS v4.0 Scoring

CVSS v4.0 uses a unique lookup-based system. Metrics are grouped into Equivalence Classes (EQ1-EQ6) to form a MacroVector. This vector is used to find a base score from a large lookup table, which is then adjusted via interpolation based on the precise metric values.

• Key Function: calculateCVSSv4Score(metrics)
• Core Logic:
  1. calculateMacroVector(metrics) determines the 6-digit macro vector (e.g., 012210).
  2. The base score is retrieved from the CVSS_V4_LOOKUP table.
  3. calculateSeverityDistances and calculateInterpolation adjust the score for a precise result.

Sources: src/lib/cvss/v4/scoring.ts:1-15, 755-788

CVSS v3.x Scoring

CVSS v3.0 and v3.1 use a formula-based approach. The roundUp function differs slightly between the two versions.

• Key Function: calculateCVSSv3Score(metrics, version)
• Core Logic:
  1. calculateISS (Impact Sub-Score) is calculated from Confidentiality, Integrity, and Availability metrics.
  2. calculateImpact adjusts the ISS based on whether the Scope (S) has changed.
  3. calculateExploitability is derived from metrics like Attack Vector (AV) and Attack Complexity (AC).
  4. calculateBaseScore combines the Impact and Exploitability scores.

Sources: src/lib/cvss/v3/scoring.ts:1-12, 290-323

CVSS v2.0 Scoring

CVSS v2.0 also uses a formula-based system, but with different metrics and coefficients.

• Key Function: calculateCVSSv2Score(metrics)
• Core Logic:
  1. calculateImpact is calculated based on C, I, and A metrics.
  2. calculateExploitability is derived from Access Vector (AV), Access Complexity (AC), and Authentication (Au).
  3. calculateBaseScore combines these two sub-scores using specific coefficients and an f(Impact) function.

Sources: src/lib/cvss/v2/scoring.ts:1-11, 281-313

Data Model and State Management

The application relies on a well-defined data model for metrics and a local persistence mechanism for score history.

Metric Definitions

All metric definitions, including their labels, descriptions, and options, are centralized in src/lib/cvss/metrics-data.ts. This allows the UI to dynamically render selection controls for any CVSS version.

The core data structures are:

// Source: src/lib/cvss/metrics-data.ts:9-27
export interface MetricOption {
    value:          string
    label:          string
    description:    string
    in_other_words: string
}

export interface MetricDefinition {
    key:         string
    label:       string
    description: string
    options:     Array<MetricOption>
}

export interface MetricGroup {
    name:        string
    description: string
    metrics:     Array<MetricDefinition>
}

Sources: src/lib/cvss/metrics-data.ts:9-27

For example, the CVSS v4.0 Attack Vector (AV) metric is defined as follows:

Value	Label	Description
N	Network (N)	The vulnerable system is bound to the network stack and the attacker's path is through OSI layer 3.
A	Adjacent (A)	The vulnerable system is bound to a protocol stack, but attack is limited at protocol level to a logically adjacent topology.
L	Local (L)	The vulnerable system is not bound to the network stack and the attacker's path is via read/write/execute capabilities.
P	Physical (P)	The attack requires the attacker to physically touch or manipulate the vulnerable system.

Sources: src/lib/cvss/metrics-data.ts:38-63

Score History and Persistence

Quant allows users to save their calculated scores for future reference. This history is managed by the ScoreManager component and stored in the browser's localStorage.

• Storage Key: cvss-score-history
• Update Mechanism: A custom event, cvss-history-update, is dispatched whenever the history is modified, allowing different parts of the application to stay in sync.

This sequence diagram shows how a score is saved to the history.

Each entry in the history is an object with the following structure:

// Inferred from src/components/ScoreHistory.tsx
interface ScoreHistoryEntry {
    id: string;
    name: string;
    score: number;
    severity: string;
    vectorString: string;
    timestamp: string; // ISO 8601 format
    version: '4.0' | '3.1' | '3.0' | '2.0';
}

Sources: src/components/ScoreHistory.tsx:40, 350-362

The ScoreManager component provides functionality to:

• List, search, and sort saved scores.
• Edit the name of an entry.
• Delete and restore scores.
• Compare multiple scores side-by-side.
• Generate charts from selected scores.
• Import and export the entire history as a JSON file.

Sources: src/components/ScoreHistory.tsx:21-26, 151-180

Conclusion

Quant is a comprehensive, privacy-focused CVSS calculator that leverages a modern, client-side technology stack to provide a fast and intuitive user experience. Its pure TypeScript scoring engine is accurate, compliant with official standards, and designed for easy integration into other projects. With features like multi-version support, advanced analytics, and local score management, Quant serves as an essential tool for anyone involved in vulnerability assessment and management.

Sources: README.md:11-14, 79-87