CVSS

The Common Vulnerability Scoring System (CVSS) is a scoring framework that provides numerical scores to assess the severity of software vulnerabilities. This TypeScript-based library offers support for CVSS versions 3.0, 3.1, and 4.0 for calculating and validating Base Scores.

---

Basics

CVSS produces numerical scores based on principal vulnerability characteristics to determine the severity of a vulnerability. These scores help compare the relative risks of different vulnerabilities.

A CVSS vector string consists of:

1. A version identifier starting with CVSS:.
2. A set of /-separated metrics. Each metric is represented as a key-value pair (metric:value).

Example Vector String

Sample CVSS v3.1 vector string:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Base Score: 3.8
Severity: Low

---

Features

1. Supported CVSS Versions:

   • CVSS 3.0
   • CVSS 3.1
   • CVSS 4.0

2. Metric Group Coverage:
   Currently supports Base Metrics. Future updates may include Temporal and Environmental Metrics.

---

Installation

Install the library using npm:

npm install --save cvss4

---

API Reference

Score Calculation

• calculateBaseScore(cvssString): number
  Computes the Base Score of a CVSS vector string.
  Example:

  import { calculateBaseScore } from 'cvss4';
  console.log(calculateBaseScore('CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'));

• calculateIss(metricsMap): number
  Calculates the Impact Sub-Score (ISS).

• calculateImpact(metricsMap, iss): number
  Computes the Impact.

• calculateExploitability(metricsMap): number
  Computes the Exploitability.

---

Validation

• validate(cvssString): void
  Validates the CVSS vector string. Throws an error if the string is invalid or unsupported.
  Example:

  import { validate } from 'cvss4';
  validate('CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N');

---

Humanization

• humanizeBaseMetric(metric: string): string
  Converts an abbreviated metric name to its full form.
  Example:

  humanizeBaseMetric('C'); // Returns: 'Confidentiality'

• humanizeBaseMetricValue(value: string, metric: string): string
  Converts an abbreviated metric value to its full form.
  Example:

  humanizeBaseMetricValue('N', 'AV'); // Returns: 'Network'

---

Usage Examples

Node.js (CommonJS)

const cvss = require('cvss4');
console.log(cvss.calculateBaseScore('CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'));

Node.js (ES Modules)

import { calculateBaseScore } from 'cvss4';
console.log(calculateBaseScore('CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'));

Browser (UMD)

<script src="./node_modules/cvss4/dist/bundle.umd.js"></script>
<script>
  alert(cvss.calculateBaseScore('CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'));
</script>

---

Development

Contributions are welcome. Please ensure your code passes linting (npm run lint) and tests (npm test) before submitting a pull request.

---

License

This project is licensed under the MIT License. See the LICENSE file for details.

Special thanks to NeuraLegion for the initial version of this library.