ae-cvss-calculator

{metæffekt} CVSS Calculator

The {metæffekt} CVSS Calculator supports all versions of the CVSS standard by FIRST to model CVSS vectors and calculate their scores. It consists of the following components:

TypeScript Library	UI
Supports CVSS versions 2.0, 3.0, 3.1 and 4.0. Available on NPM as ae-cvss-calculator and installable via: npm install ae-cvss-calculator	The calculator is available on our webpage for you to try out and link from your applications. The source code can be found in the site directory.

Installation

This project implements the following versions of the CVSS standard by FIRST:

• CVSS:2.0 - https://www.first.org/cvss/v2/guide
• CVSS:3.0 - https://www.first.org/cvss/v3.0/specification-document
• CVSS:3.1 - https://www.first.org/cvss/v3.1/specification-document
• CVSS:4.0 - https://www.first.org/cvss/v4.0/specification-document

Available on NPM as ae-cvss-calculator and installable via:

npm install ae-cvss-calculator

Usage

The CVSS versions are implemented in the following classes:

• Cvss2.ts
• Cvss3P0.ts
• Cvss3P1.ts
• Cvss4P0.ts

A couple of examples, using the methods that can construct and modify vectors and calculate the several different CVSS scores:

Usage V4.0

const cvss4 = new Cvss4P0()
cvss4.applyVector('CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L')
cvss4.applyVector('SC:L/SI:L/SA:L')
console.log(cvss4.toString())

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

---

const cvss4 = new Cvss4P0('CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L')
cvss4.applyComponentString('MAC', 'L')
cvss4.applyComponent(Cvss4P0Components.AC, Cvss4P0Components.AC_VALUES.H) // alternatively via types
const scores = cvss4.calculateScores()
console.log(scores)

{
  "overall": 5.3,
  "vector": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/MAV:X/MAC:L/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X"
}

Usage V3.1

const cvss3 = new Cvss3P1('CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L')
cvss3.applyComponentString("AC", "L")
console.log(cvss3.calculateScores(false))
console.log(cvss3.calculateScores(true)) // normalize all scores to a scale 0-10 (CVSS:3.1 Exploitability, Impact)

{
  "base": 7.3,
  "impact": 3.4,
  "exploitability": 3.9,
  "temporal": null,
  "environmental": null,
  "modifiedImpact": null,
  "overall": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}

{
  "base": 7.3,
  "impact": 5.7,
  "exploitability": 10,
  "temporal": null,
  "environmental": null,
  "modifiedImpact": null,
  "overall": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}

Build

git clone https://github.com/org-metaeffekt/metaeffekt-universal-cvss-calculator
cd metaeffekt-universal-cvss-calculator/ae-cvss-calculator
npm install
npm run build

The minified ae-cvss-calculator.js can be found in the dist directory.

Otherwise, you can also build the packaged version by running

npm run pack