CVSS Metrics Data and Types
Relevant source files
The following files were used as context for generating this wiki page:The Quant application supports multiple versions of the Common Vulnerability Scoring System (CVSS), including v4.0, v3.1, v3.0, and v2.0. The foundation for this multi-version support is a robust system of TypeScript types and structured data objects that define the metrics for each CVSS version. This ensures type safety, consistency, and separation of concerns between the scoring logic and the user interface presentation.
The core of this system resides in two key files: src/lib/cvss/types.ts, which provides comprehensive TypeScript definitions for all CVSS versions, and src/lib/cvss/metrics-data.ts, which contains the human-readable text, descriptions, and labels used to render the calculator's UI. This architecture allows the scoring engines to operate on strongly-typed metric objects while the UI can dynamically display detailed information for each metric.
Sources: src/lib/cvss/types.ts, src/lib/cvss/metrics-data.ts, README.md:27-32
Core Type Definitions
The file src/lib/cvss/types.ts establishes a set of common and version-specific types that are used throughout the application, from the scoring engines to the UI components.
Sources: src/lib/cvss/types.ts
Common Score and Severity Types
A set of base types is defined to ensure a consistent structure for score results regardless of the CVSS version.
SeverityRating: A union type representing the qualitative severity rating:None|Low|Medium|High|Critical.ScoreResult: An interface for the basic score output, containing the numericscore, qualitativeseverity, and thevectorstring.DetailedScore: ExtendsScoreResultto include a breakdown of component scores, such asbaseScore,temporalScore,environmentalScore,impactScore, andexploitabilityScore.
The following diagram illustrates the relationship between these core types and their version-specific implementations.
This diagram shows how DetailedScore inherits from ScoreResult and is then extended by version-specific score interfaces.
Sources: src/lib/cvss/types.ts:20-56, src/lib/cvss/types.ts:265-275, src/lib/cvss/types.ts:340-349, src/lib/cvss/types.ts:430-439
Metric Data Structures
To populate the UI with metric information, src/lib/cvss/metrics-data.ts defines a clear structure. This data is consumed by UI components to render metric selection controls.
MetricOption: Defines a single choice for a metric (e.g., Attack Vector: Network).MetricDefinition: Represents a full metric (e.g., Attack Vector), containing its key, label, description, and an array ofMetricOptions.MetricGroup: Groups related metrics together (e.g., Base Metrics, Temporal Metrics).
The relationship between these interfaces is shown below.
This ER diagram shows that a MetricGroup contains multiple MetricDefinitions, and each MetricDefinition has multiple MetricOptions.
Sources: src/lib/cvss/metrics-data.ts:8-23
Version-Specific Metrics Interfaces
Each supported CVSS version has a dedicated TypeScript interface that defines the complete set of metrics for that version. These interfaces are crucial for the scoring engines, ensuring that all required metrics are present and correctly typed.
Sources: src/lib/cvss/types.ts
CVSS v4.0
CVSS v4.0 introduces the most extensive set of metrics, including new Base metrics for Subsequent System Impact, Threat metrics, and non-scoring Supplemental metrics.
- Interface:
CVSSv4Metrics - Score Interface:
CVSSv4Score(includesmacroVectorandnomenclature)
The CVSSv4Metrics interface is composed of several metric groups:
| Group | Description | Example Metrics |
|---|---|---|
| Base | Intrinsic characteristics of the vulnerability. | AV, AC, AT, PR, UI, VC, VI, VA, SC, SI, SA |
| Threat | Characteristics that change over time, like exploit availability. | E (Exploit Maturity) |
| Environmental | Characteristics unique to a user's environment. | CR, IR, AR, MAV, MAC, etc. |
| Supplemental | Additional context that does not affect the score. | S (Safety), AU (Automatable), R (Recovery) |
Sources: src/lib/cvss/types.ts:182-250, src/lib/cvss/types.ts:265-275, src/components/FAQAccordion.tsx:90-107
CVSS v3.1 / v3.0
CVSS v3.x metrics are grouped into Base, Temporal, and Environmental categories. The Scope (S) metric is a key feature of this version.
- Interface:
CVSSv3Metrics - Score Interface:
CVSSv3Score
The CVSSv3Metrics interface is structured as follows:
| Group | Description | Metrics |
|---|---|---|
| Base | Intrinsic characteristics of the vulnerability. | AV, AC, PR, UI, S, C, I, A |
| Temporal | Time-dependent characteristics. | E, RL, RC |
| Environmental | Environment-specific adjustments. | CR, IR, AR, MAV, MAC, etc. |
Sources: src/lib/cvss/types.ts:309-338, src/lib/cvss/types.ts:340-349, src/components/CVSSVersionsTabs.tsx:129-150
CVSS v2.0
CVSS v2.0 is the legacy standard with a different set of metrics and value options compared to later versions. For example, it uses Authentication (Au) instead of Privileges Required (PR).
- Interface:
CVSSv2Metrics - Score Interface:
CVSSv2Score
The CVSSv2Metrics interface contains the following groups:
| Group | Description | Metrics |
|---|---|---|
| Base | Intrinsic characteristics of the vulnerability. | AV, AC, Au, C, I, A |
| Temporal | Time-dependent characteristics. | E, RL, RC |
| Environmental | Environment-specific characteristics. | CDP, TD, CR, IR, AR |
Sources: src/lib/cvss/types.ts:398-428, src/lib/cvss/types.ts:430-439, src/components/CVSSVersionsTabs.tsx:227-248
Data Flow and Usage
The types and data structures work together to power the application. The following diagram shows the flow of information from the definition files to the scoring engines and UI.
This flowchart shows that types.ts informs the scoring engines, while metrics-data.ts provides data for UI components. The results are then combined to produce the final rendered UI.
Sources: src/lib/cvss/types.ts, src/lib/cvss/metrics-data.ts, src/lib/cvss/v4/scoring.ts, src/components/CVSSVersionsTabs.tsx
Severity Ratings
A final piece of the data system is the mapping of numeric scores to qualitative severity ratings. The getSeverityRating function in metrics-data.ts handles this, but the thresholds differ between CVSS versions.
- CVSS v3.x and v4.0 use five levels: None, Low, Medium, High, and Critical.
- CVSS v2.0 uses four levels: None, Low, Medium, and High.
The thresholds are defined as constants within each version's scoring engine.
| Rating | CVSS v2.0 Score Range | CVSS v3.x & v4.0 Score Range |
|---|---|---|
| None | 0.0 | 0.0 |
| Low | 0.1 - 3.9 | 0.1 - 3.9 |
| Medium | 4.0 - 6.9 | 4.0 - 6.9 |
| High | 7.0 - 10.0 | 7.0 - 8.9 |
| Critical | N/A | 9.0 - 10.0 |
Sources: src/lib/cvss/v2/scoring.ts:25-28, src/lib/cvss/v3/scoring.ts:31-35, src/lib/cvss/v4/scoring.ts:28-32, src/lib/cvss/metrics-data.ts:1330-1398
Conclusion
The CVSS metrics data and type definitions form a critical architectural layer in the Quant application. By defining clear, version-specific interfaces in types.ts and separating UI-facing text into metrics-data.ts, the system achieves strong type safety, maintainability, and a clean separation between business logic and presentation. This structured approach is essential for accurately supporting multiple complex CVSS standards and providing a rich, informative user experience.