CVSS v3.x Scoring Logic
Relevant source files
The following files were used as context for generating this wiki page:The CVSS v3.x scoring module provides a complete, client-side implementation for calculating vulnerability scores based on the Common Vulnerability Scoring System versions 3.0 and 3.1. This engine is a core component of the Quant calculator, translating user-selected metric values into quantitative scores and qualitative severity ratings. It is designed as a pure TypeScript module with no external dependencies, ensuring fast and accurate calculations directly within the user's browser.
The implementation strictly follows the official specifications for both CVSS v3.0 and v3.1, including the subtle but important differences in their rounding functions and impact calculations. The module exposes a clear API for calculating scores, generating vector strings, and parsing them, which is consumed by the main calculator UI to provide a real-time scoring experience.
Sources: src/lib/cvss/v3/scoring.ts:1-16, README.md:15-17, src/components/FAQAccordion.tsx:49-57
Core Concepts
The CVSS v3.x scoring is based on three metric groups: Base, Temporal, and Environmental. The final score is derived from a series of formula-based calculations that combine these metrics.
- Base Score: Represents the intrinsic qualities of a vulnerability. It is composed of two sub-scores:
- Impact Sub-Score (ISS): Measures the impact on Confidentiality (C), Integrity (I), and Availability (A).
- Exploitability Score: Measures the ease of exploitation based on Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), and User Interaction (UI).
- Temporal Score: Modifies the Base Score based on time-dependent factors like Exploit Code Maturity (E), Remediation Level (RL), and Report Confidence (RC).
- Environmental Score: Further modifies the score based on factors specific to a user's environment, such as Security Requirements (CR, IR, AR) and modified base metrics (e.g., MAV, MAC).
The primary difference between CVSS v3.0 and v3.1 lies in the rounding mechanism and the formula for calculating the Impact score when the Scope is "Changed".
Sources: src/lib/cvss/v3/scoring.ts:5-16, src/components/CVSSVersionsTabs.tsx:135-172, src/lib/cvss/metrics-data.ts:500-503
Data Structures
The scoring engine relies on two primary data structures defined in types.ts.
CVSSv3Metrics
This interface holds all possible metric values for a CVSS v3.x assessment. It includes Base, Temporal, and Environmental metrics.
| Field | Type | Description |
|---|---|---|
AV | CVSSv3AttackVector ('N'...'P') | Attack Vector |
AC | CVSSv3AttackComplexity ('L'...'H') | Attack Complexity |
PR | CVSSv3PrivilegesRequired ('N'...'H') | Privileges Required |
UI | CVSSv3UserInteraction ('N'...'R') | User Interaction |
S | CVSSv3Scope ('U'...'C') | Scope |
C | CVSSv3ImpactValue ('H'...'N') | Confidentiality Impact |
I | CVSSv3ImpactValue ('H'...'N') | Integrity Impact |
A | CVSSv3ImpactValue ('H'...'N') | Availability Impact |
E | CVSSv3ExploitMaturity ('X'...'U') | Exploit Code Maturity |
RL | CVSSv3RemediationLevel ('X'...'O') | Remediation Level |
RC | CVSSv3ReportConfidence ('X'...'U') | Report Confidence |
CR | CVSSv3SecurityRequirement ('X'...'L') | Confidentiality Requirement |
IR | CVSSv3SecurityRequirement ('X'...'L') | Integrity Requirement |
AR | CVSSv3SecurityRequirement ('X'...'L') | Availability Requirement |
MAV...MA | `... | NotDefined` |
Sources: src/lib/cvss/types.ts:311-348
CVSSv3Score
This interface represents the output of a successful calculation, containing the final score and all its components.
| Field | Type | Description |
|---|---|---|
score | number | The final calculated score (environmental, temporal, or base). |
severity | SeverityRating | The qualitative severity rating (None, Low, Medium, High, Critical). |
vector | string | The generated CVSS v3.x vector string. |
baseScore | number | The calculated Base Score. |
temporalScore | `number | undefined` |
environmentalScore | `number | undefined` |
impactScore | number | The calculated Impact Score. |
exploitabilityScore | number | The calculated Exploitability Score. |
version | `'3.1' | '3.0'` |
Sources: src/lib/cvss/types.ts:353-363
Scoring Pipeline
The calculation process follows a specific sequence of steps to derive the final score from the input metrics. The main function calculateCVSSv3Score orchestrates this entire flow.
This diagram shows the high-level data flow for calculating a CVSS v3.x score.
Sources: src/lib/cvss/v3/scoring.ts:547-603
Key Formulas and Calculations
The scoring is based on a set of formulas defined in the CVSS v3.x specification.
Impact Sub-Score (ISS)
The ISS is a preliminary score that combines the impacts on Confidentiality, Integrity, and Availability.
- Formula:
ISS = 1 - (1 - C_weight) * (1 - I_weight) * (1 - A_weight) - Function:
calculateISS(c, i, a)
Sources: src/lib/cvss/v3/scoring.ts:205-208
Exploitability Score
This score measures how easily a vulnerability can be exploited.
- Formula:
Exploitability = 8.22 * AV_weight * AC_weight * PR_weight * UI_weight - Function:
calculateExploitability(av, ac, pr, ui)
Sources: src/lib/cvss/v3/scoring.ts:238-241
Impact Score
The Impact score is derived from the ISS and is adjusted based on whether the Scope metric is Changed or Unchanged.
- If Scope is Unchanged:
Impact = 6.42 * ISS - If Scope is Changed:
Impact = 7.52 * (ISS - 0.029) - 3.25 * (ISS - 0.02)^15(for v3.1) - Function:
calculateImpact(iss, scopeChanged, version)
Sources: src/lib/cvss/v3/scoring.ts:215-234
Base Score
The Base Score combines the Impact and Exploitability scores. If the Scope is Changed, an additional multiplier is applied. The result is capped at 10.0.
- If Scope is Unchanged:
BaseScore = Roundup(min(Impact + Exploitability, 10)) - If Scope is Changed:
BaseScore = Roundup(min(1.08 * (Impact + Exploitability), 10)) - Function:
calculateBaseScore(impact, exploitability, scopeChanged, roundup)
Sources: src/lib/cvss/v3/scoring.ts:270-291
Temporal and Environmental Scores
- Temporal Score:
Roundup(BaseScore * E_weight * RL_weight * RC_weight) - Environmental Score: This is a more complex recalculation of the Base Score using modified metrics (e.g.,
MAVinstead ofAV) and security requirement weights (CR, IR, AR). The final result is then adjusted by the temporal multipliers.
Sources: src/lib/cvss/v3/scoring.ts:297-305, src/lib/cvss/v3/scoring.ts:311-396
Metric Weights and Constants
The formulas use predefined weights for each metric option. These are stored in constant objects.
Base Metric Weights
| Metric | Value | Weight |
|---|---|---|
| AV | N | 0.85 |
| A | 0.62 | |
| L | 0.55 | |
| P | 0.20 | |
| AC | L | 0.77 |
| H | 0.44 | |
| UI | N | 0.85 |
| R | 0.62 | |
| C/I/A | H | 0.56 |
| L | 0.22 | |
| N | 0.00 |
Sources: src/lib/cvss/v3/scoring.ts:52-92
Privileges Required (PR) Weights
The weights for PR are unique because they depend on the Scope metric.
| Scope | PR Value | Weight |
|---|---|---|
| Unchanged | N | 0.85 |
| L | 0.62 | |
| H | 0.27 | |
| Changed | N | 0.85 |
| L | 0.68 | |
| H | 0.50 |
Sources: src/lib/cvss/v3/scoring.ts:133-146
Version Differences: v3.0 vs v3.1
The scoring engine correctly handles the differences between CVSS v3.0 and v3.1.
-
Rounding Function: Each version has a distinct
roundupfunction. v3.1 rounds up to one decimal place, while v3.0 rounds to the nearest 0.1.roundUpV31(value)roundUpV30(value)
Sources: src/lib/cvss/v3/scoring.ts:151-169
-
Impact Calculation (Scope Changed): The formula for calculating the Impact score when Scope is
Changeddiffers slightly. The v3.0 formula applies a multiplier to the ISS value within the exponentiation.- v3.1:
... - 3.25 * (iss - 0.02) ** 15 - v3.0:
... - 3.25 * (iss * 0.9731 - 0.02) ** 15
Sources: src/lib/cvss/v3/scoring.ts:227-233
- v3.1:
API and Usage
The module is exposed via src/lib/cvss/v3/index.ts and provides several key functions for integration into the application.
This sequence diagram illustrates how the CVSSGenericCalculator component uses the scoring module when a user changes a metric.
Key Exported Functions
| Function | Description |
|---|---|
calculateCVSSv3Score(metrics, version) | The main entry point. Takes a CVSSv3Metrics object and a version string ('3.0' or '3.1') and returns a CVSSv3Score object. |
generateVector(metrics, version) | Creates a valid CVSS v3.x vector string from a CVSSv3Metrics object. |
parseVector(vector) | Parses a vector string and returns a CVSSv3Metrics object and the detected version. |
createDefaultMetrics() | Returns a CVSSv3Metrics object initialized with the least severe values. |
calculateOptionImpact(metrics, key, value, version) | Calculates the score change that would result from selecting a different metric option. Used by the UI to show users the impact of their choices in real-time. |
getSeverityRating(score) | Converts a numeric score into a qualitative severity string. |
Sources: src/lib/cvss/v3/index.ts:6-14, src/lib/cvss/v3/scoring.ts
Severity Rating
The final numeric score is mapped to a qualitative severity rating based on predefined thresholds.
| Score Range | Rating |
|---|---|
| 0.0 | None |
| 0.1 - 3.9 | Low |
| 4.0 - 6.9 | Medium |
| 7.0 - 8.9 | High |
| 9.0 - 10.0 | Critical |
Sources: src/lib/cvss/v3/scoring.ts:246-264, src/lib/cvss/metrics-data.ts:1020-1065
Conclusion
The CVSS v3.x scoring module is a robust and precise implementation of the official FIRST.org standards for both v3.0 and v3.1. Its pure TypeScript, formula-driven approach ensures that all calculations are performed accurately and efficiently on the client side. By encapsulating the complex scoring logic, handling version-specific nuances, and providing a clean API, the module serves as a foundational element of the Quant application, enabling developers to easily integrate and display real-time CVSS v3.x scores.
Sources: src/lib/cvss/v3/scoring.ts, src/lib/cvss/index.ts:1-29