CVSS v2.0 Scoring Logic
Relevant source files
The following files were used as context for generating this wiki page:The CVSS v2.0 scoring module provides a complete implementation of the legacy Common Vulnerability Scoring System version 2.0. As described in the project's documentation, this is maintained for historical scoring and legacy vulnerability tracking, while newer versions like v4.0 are recommended for new assessments. The logic is encapsulated in pure JavaScript (TypeScript) functions, ensuring fast, client-side calculations that can run offline.
This system is a core part of the Quant calculator, allowing users to assess vulnerabilities using the older standard. The implementation adheres strictly to the official CVSS v2.0 guide, calculating Base, Temporal, and Environmental scores based on a set of metric weights and formulas.
Sources: src/lib/cvss/v2/scoring.ts:1-11, README.md:31-34, src/components/FAQAccordion.tsx:13-22
Core Architecture
The CVSS v2.0 scoring engine is a set of pure functions responsible for taking a CVSSv2Metrics object and producing a CVSSv2Score result. The entire calculation process happens on the client-side within the browser, with no data being sent to a server.
Sources: src/components/FAQAccordion.tsx:32-35, src/lib/cvss/v2/scoring.ts
Key Data Structures
The scoring process revolves around two primary data structures defined in src/lib/cvss/types.ts.
CVSSv2Metrics: An interface representing all possible CVSS v2.0 metrics, including Base, Temporal, and Environmental groups.CVSSv2Score: An interface representing the output of a calculation, containing the final score, severity, vector string, and all sub-scores (Base, Temporal, Environmental, Impact, Exploitability).
The following diagram shows the relationship between these structures.
Sources: src/lib/cvss/types.ts:348-388
Default Metrics
When initializing the calculator, a default set of metrics corresponding to the least severe vulnerability is used. This ensures a starting score of 0.0.
| Metric | Default Value | Description |
|---|---|---|
| AV | L | Local (hardest to exploit) |
| AC | H | High (most complex) |
| Au | M | Multiple (most authentication required) |
| C | N | None (no confidentiality impact) |
| I | N | None (no integrity impact) |
| A | N | None (no availability impact) |
| E, RL, RC | ND | Not Defined |
| CDP, TD, CR, IR, AR | ND | Not Defined |
Sources: src/lib/cvss/v2/scoring.ts:365-385
Scoring Calculation
The final score is calculated in a series of steps, starting with the Base Score and optionally adjusting it with Temporal and Environmental metrics. The calculateCVSSv2Score function orchestrates this entire process.
Sources: src/lib/cvss/v2/scoring.ts:388-423
This diagram illustrates the calculation flow.
Sources: src/lib/cvss/v2/scoring.ts:388-423
Metric Weights
Each metric value is assigned a specific numeric weight used in the scoring formulas. These are defined as constants within the scoring module.
Sources: src/lib/cvss/v2/scoring.ts:51-140
Base Metrics
| Metric | Value | Weight |
|---|---|---|
| Access Vector (AV) | Local (L) | 0.395 |
| Adjacent (A) | 0.646 | |
| Network (N) | 1.0 | |
| Access Complexity (AC) | High (H) | 0.35 |
| Medium (M) | 0.61 | |
| Low (L) | 0.71 | |
| Authentication (Au) | Multiple (M) | 0.45 |
| Single (S) | 0.56 | |
| None (N) | 0.704 | |
| Confidentiality (C) | None (N) | 0 |
| Partial (P) | 0.275 | |
| Complete (C) | 0.66 | |
| Integrity (I) | None (N) | 0 |
| Partial (P) | 0.275 | |
| Complete (C) | 0.66 | |
| Availability (A) | None (N) | 0 |
| Partial (P) | 0.275 | |
| Complete (C) | 0.66 |
Sources: src/lib/cvss/v2/scoring.ts:54-89
Core Formulas
The scoring logic is built upon several key formulas defined in the specification.
-
Impact Score:
Impact = 10.41 * (1 - (1 - C) * (1 - I) * (1 - A))
Sources: src/lib/cvss/v2/scoring.ts:150-152 -
Exploitability Score:
Exploitability = 20 * AV * AC * Au
Sources: src/lib/cvss/v2/scoring.ts:158-160 -
Base Score:
BaseScore = Roundup(((0.6 * Impact) + (0.4 * Exploitability) - 1.5) * f(Impact))
Wheref(Impact)is 0 if Impact is 0, otherwise it is 1.176.
Sources: src/lib/cvss/v2/scoring.ts:174-185
Severity Rating
The final numeric score (from 0.0 to 10.0) is mapped to a qualitative severity rating. CVSS v2.0 uses a three-tiered rating system (Low, Medium, High), which differs from the five-tiered system in later versions.
| Score Range | Severity |
|---|---|
| 0.0 | None |
| 0.1 - 3.9 | Low |
| 4.0 - 6.9 | Medium |
| 7.0 - 10.0 | High |
Sources: src/lib/cvss/v2/scoring.ts:25-28, src/lib/cvss/v2/scoring.ts:246-258, src/components/CVSSVersionsTabs.tsx:266-268
Vector String Handling
The module includes functions to convert between the CVSSv2Metrics object and the standardized CVSS v2.0 vector string.
generateVector(metrics: CVSSv2Metrics): Creates a vector string like(AV:N/AC:L/Au:N/C:C/I:C/A:C)from a metrics object. It intelligently omits metrics with "Not Defined" (ND) values.parseVector(vector: string): Parses a vector string and populates aCVSSv2Metricsobject with the corresponding values.
Sources: src/lib/cvss/v2/scoring.ts:261-301, src/lib/cvss/v2/scoring.ts:304-328
Integration with UI
The CVSS v2.0 scoring logic is exposed through a barrel file src/lib/cvss/v2/index.ts for easy consumption by other parts of the application.
The primary consumer is the CVSSGenericCalculator component, which dynamically calls the appropriate scoring function based on the selected CVSS version.
Sources: src/lib/cvss/v2/index.ts:1-12, src/components/CVSSGenericCalculator.tsx:24-27, src/components/CVSSGenericCalculator.tsx:238-241
The following sequence diagram shows how a user interaction in the UI triggers a re-calculation.
The module also provides a calculateOptionImpact function, which allows the UI to show the user how choosing a different metric value would affect the final score in real-time.
Sources: src/lib/cvss/v2/scoring.ts:426-447, src/components/CVSSGenericCalculator.tsx:195-214
Summary
The CVSS v2.0 scoring module is a self-contained, accurate, and formula-driven implementation of the legacy CVSS v2.0 standard. It provides all necessary functions for calculating scores, handling vector strings, and integrating seamlessly into the Quant application's user interface to support historical vulnerability analysis. Its pure-function design ensures performance and reliability, running entirely on the client side.