ae-cvss-calculator
Version:
A CVSS vector modeling and score calculation implementation for all CVSS versions by {metæffekt}.
1 lines • 182 kB
JavaScript
!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.CvssCalculator=t():e.CvssCalculator=t()}(this,(()=>(()=>{"use strict";var e={44:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.CvssVector=void 0;class o{constructor(e,t,o){this.vector=e,this.normalize=t,this.scores=o}isUpToDate(e,t){return this.vector===e&&this.normalize===t}getScores(){return this.scores}}t.CvssVector=class{constructor(e){this.vectorChangedListeners=[],this.components=new Map,this.clearComponents(),e&&this.applyVector(e)}calculateScores(e=!1){const t=this.toString(!0);if(this.cachedScores&&this.cachedScores.isUpToDate(t,e))return this.cachedScores.getScores();const a=this.calculateScoresInternal(e);return this.cachedScores=new o(t,e,a),a}fillBaseMetrics(){for(const[e,t]of this.getRegisteredComponents())if("base"===e.name){for(const e of t){const t=e.values[1];t&&this.applyComponent(e,t)}return}throw new Error("No base category found")}clearComponents(){this.getRegisteredComponents().forEach(((e,t)=>{e.forEach((e=>this.components.set(e,e.values[0])))}))}addVectorChangedListener(e){this.vectorChangedListeners.push(e)}normalizeVector(e){return e.replace(/\(/g,"").replace(/\)/g,"").replace(/CVSS:\d+\.?\d?/g,"").replace(/\s/g,"").replace(/\\/g,"").replace(/^\//g,"").replace(/\/$/g,"").trim()}findComponent(e){for(const t of this.getRegisteredComponents().values()){const o=t.find((t=>t.name===e||t.shortName===e));if(o)return o}return Array.from(this.components.keys()).find((t=>t.name===e||t.shortName===e))}applyVector(e){this.applyVectorCount(e)}applyVectorCount(e){const t=this.normalizeVector(e).split("/");let o=0;return t.forEach((e=>{if(0===e.length)return;const[t,a]=e.split(":");0!==t.length&&0!==a.length?this.applyComponentString(t,a,!1)&&o++:console.warn("Invalid component/value pair",e)})),this.vectorChangedListeners.forEach((e=>e(this))),o}applyComponentString(e,t,o=!0){const a=this.findComponent(e);if(a){const i=a.values.find((e=>e.name===t||e.shortName===t));if(i)return this.components.get(a)!==i&&(this.applyComponent(a,i),o&&this.vectorChangedListeners.forEach((e=>e(this))),!0);throw new Error(`Unknown component value ${t} for component ${e}`)}throw new Error(`Unknown component ${e} when setting value ${t}`)}applyComponentStringSilent(e,t,o=!0){try{return this.applyComponentString(e,t,o)}catch(e){return!1}}applyComponent(e,t,o=!0){this.components.set(e,t),o&&this.vectorChangedListeners.forEach((e=>e(this)))}applyVectorPartsIf(e,t,o){if(!e)return 0;const a=this.normalizeVector(e);if(0===a.length)return 0;const i=a.split("/");let s=0;for(const e of i){if(!e)continue;const a=e.split(":",2),i=this.clone(),n=t(i);if(2===a.length){i.applyComponentStringSilent(a[0],a[1]);const e=t(i);o?e<=n&&(s+=this.applyComponentStringSilent(a[0],a[1])?1:0):e>=n&&(s+=this.applyComponentStringSilent(a[0],a[1])?1:0)}else console.warn("Unknown vector argument:",e)}return s}applyVectorPartsIfLower(e,t){return this.applyVectorPartsIf(e,t,!0)}applyVectorPartsIfHigher(e,t){return this.applyVectorPartsIf(e,t,!1)}applyVectorPartsIfLowerVector(e,t){return this.applyVectorPartsIf(e.toStringDefinedParts(),t,!0)}applyVectorPartsIfHigherVector(e,t){return this.applyVectorPartsIf(e.toStringDefinedParts(),t,!1)}getComponent(e){const t=this.components.get(e);if(!t)throw new Error(`Unknown component: ${e.name}`);return t}getComponentByString(e){const t=this.findComponent(e);if(!t)throw new Error(`Unknown component: ${e}`);const o=this.components.get(t);if(!o)throw new Error(`Unknown component: ${e}`);return o}getComponentByStringOpt(e){try{return this.getComponentByString(e)}catch(e){return null}}size(){return Array.from(this.components.values()).filter(this.isComponentValueDefined).length}getFirstDefinedComponent(e){return e.map((e=>this.components.get(e))).find(this.isComponentValueDefined)}toString(e=!1,t=this.getRegisteredComponents(),o=!1){let a="";for(const[i,s]of t)if(e||this.isCategoryPartiallyDefined(i))for(const e of s){const t=this.components.get(e);if(t){if(o&&!this.isComponentValueDefined(t))continue;a+=`${e.shortName}:${t.shortName}/`}}return this.getVectorPrefix()+a.slice(0,-1)}toStringDefinedParts(){return this.toString(!1,this.getRegisteredComponents(),!0)}isCategoryFullyDefined(e){const t=this.getRegisteredComponents().get(e);return!!t&&t.every((e=>void 0!==this.components.get(e)&&"ND"!==this.components.get(e).shortName&&"X"!==this.components.get(e).shortName))}isCategoryPartiallyDefined(e){const t=this.getRegisteredComponents().get(e);return!!t&&t.some((e=>void 0!==this.components.get(e)&&"ND"!==this.components.get(e).shortName&&"X"!==this.components.get(e).shortName))}round(e,t){let o=Math.pow(10,t);return Math.round(e*o)/o}roundUp(e){let t=Math.round(1e5*e);return t%1e4==0?t/1e5:(Math.floor(t/1e4)+1)/10}normalizeScore(e,t){return 10===t?e:this.round(this.mapRange(e,0,t,0,10),1)}mapRange(e,t,o,a,i){return(e-t)/(o-t)*(i-a)+a}pickRandomDefinedComponentValue(e){for(let t=0;t<999999;t++){const t=e.values[Math.floor(Math.random()*e.values.length)];if("X"!==t.shortName&&"ND"!==t.shortName&&!t.hide)return t}}clone(){const e=new this.constructor;return e.components=new Map(this.components),e}diffVector(e){const t=new this.constructor;for(const[o,a]of this.getRegisteredComponents())for(const o of a){const a=this.components.get(o),i=e.components.get(o),s=this.isComponentValueDefined(a),n=this.isComponentValueDefined(i);s&&n&&a.shortName!==i.shortName||!s&&n?t.applyComponent(o,i):s&&!n&&t.applyComponent(o,a)}return t}applyEnvironmentalMetricsOntoBase(){for(const[e,t]of this.getRegisteredComponents())for(const e of t){const t=this.components.get(e);t&&e.baseMetricEquivalent&&this.isComponentValueDefined(t)&&(e.baseMetricEquivalentMapper?this.applyComponentString(e.baseMetricEquivalent.shortName,e.baseMetricEquivalentMapper(t).shortName,!1):this.applyComponentString(e.baseMetricEquivalent.shortName,t.shortName,!1),this.applyComponent(e,e.values[0],!1))}this.vectorChangedListeners.forEach((e=>e(this)))}isComponentValueDefined(e){return void 0!==e&&"ND"!==e.shortName&&"X"!==e.shortName}static _reorderAttributeSeverityOrder(e){const t=[];return e.forEach(((e,o)=>{t.push([e])})),t}}},696:(e,t,o)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.fromVector=function(e,t=void 0){if(t){const o=h[t];if(o)return new o(e)}const o=h[e];if(o)return new o;for(let t in h){const o=h[t];if(e.startsWith(t))try{return new o(e)}catch(e){}}for(let t in h){const o=h[t];try{return new o(e)}catch(e){}}return null},t.applyVectorPartsIfMetricsLower=function(e,t){return t?E(e,t,((t,o,a,i,s)=>{const n=u(e,o,a,i,s);return n.newSeverity<=n.oldSeverity})):0},t.applyVectorPartsIfMetricsHigher=function(e,t){return t?E(e,t,((t,o,a,i,s)=>{const n=u(e,o,a,i,s);return n.newSeverity>=n.oldSeverity})):0};const a=o(496),i=o(500),s=o(867),n=o(151),r=o(703),c=o(431),l=o(284),m=o(146),h={"CVSS:2.0":a.Cvss2,"2.0":a.Cvss2,"CVSS:3.0":i.Cvss3P0,"3.0":i.Cvss3P0,"CVSS:3.1":s.Cvss3P1,3.1:s.Cvss3P1,"CVSS:4.0":n.Cvss4P0,"4.0":n.Cvss4P0};function E(e,t,o){if(!t)return 0;const a=e.normalizeVector(t);if(0===a.length)return 0;const i=a.split("/");let s=0;for(const t of i){if(!t)continue;const a=t.split(":",2);if(2===a.length){const t=a[0],i=a[1],n=e.getComponentByStringOpt(t),r=t.startsWith("M"),c=r?t.replace("M",""):t,l=e.getComponentByStringOpt(c),m=r?t:`M${t}`,h=e.getComponentByStringOpt(m),E=(null==n?void 0:n.shortName)||"X",u=e.applyComponentStringSilent(t,i),d=e.getComponentByStringOpt(t);u&&o(n,l,h,d,r)?s++:e.applyComponentStringSilent(t,E)}else console.warn("Unknown vector argument:",t)}return s}function u(e,t,o,a,i){return{oldSeverity:d(e,"NOT_DEFINED"!==(null==o?void 0:o.name)&&"NULL"!==(null==o?void 0:o.name)||!i?t:o),newSeverity:d(e,a)}}function d(e,t){if(!t)return-1;let o=[];if(e instanceof a.Cvss2?o=r.Cvss2Components.ATTRIBUTE_SEVERITY_ORDER:e instanceof i.Cvss3P0?o=c.Cvss3P0Components.ATTRIBUTE_SEVERITY_ORDER:e instanceof s.Cvss3P1?o=l.Cvss3P1Components.ATTRIBUTE_SEVERITY_ORDER:e instanceof n.Cvss4P0&&(o=m.Cvss4P0Components.ATTRIBUTE_SEVERITY_ORDER),0===o.length)return console.warn("Unknown",e.getVectorName(),"severity order list for attribute type:",t),-1;for(let e=0;e<o.length;e++)if(o[e].includes(t))return e;return console.warn("Unknown",e.getVectorName(),"attribute type:",t),-1}},496:(e,t,o)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.Cvss2=void 0;const a=o(44),i=o(703);class s extends a.CvssVector{constructor(e){super(e)}getRegisteredComponents(){return i.Cvss2Components.REGISTERED_COMPONENTS}getVectorPrefix(){return""}getVectorName(){return"CVSS:2.0"}fillAverageVector(){this.applyVector("AV:A/AC:M/Au:N/C:P/I:P/A:P")}fillRandomBaseVector(){const e=i.Cvss2Components.BASE_CATEGORY_VALUES;for(let t=0;t<e.length;t++){const o=e[t],a=super.pickRandomDefinedComponentValue(o);if(!a)return console.warn("Failed to pick random vector component for",o),void this.fillAverageVector();this.applyComponent(o,a)}}calculateScoresInternal(e=!1){const t=this.isBaseFullyDefined(),o=this.isAnyTemporalDefined(),a=this.isAnyEnvironmentalDefined();return{normalized:e,base:t?super.round(this.calculateExactBaseScore(),1):void 0,impact:t?super.round(this.calculateExactImpactScore(),1):void 0,exploitability:t?super.round(this.calculateExactExploitabilityScore(),1):void 0,temporal:t&&o?super.round(this.calculateExactTemporalScore(),1):void 0,environmental:t&&a?super.round(this.calculateExactEnvironmentalScore(),1):void 0,modifiedImpact:t&&a?super.round(this.calculateExactAdjustedImpactScore(),1):void 0,overall:super.round(this.calculateExactOverallScore(),1),vector:this.toString()}}calculateExactBaseScore(){if(!this.isBaseFullyDefined())return 0;let e=this.calculateExactImpactScore();return(.6*e+.4*this.calculateExactExploitabilityScore()-1.5)*this.f(e)}calculateExactImpactScore(){return this.isBaseFullyDefined()?10.41*(1-(1-this.getComponent(i.Cvss2Components.C).value)*(1-this.getComponent(i.Cvss2Components.I).value)*(1-this.getComponent(i.Cvss2Components.A).value)):0}calculateExactExploitabilityScore(){return this.isBaseFullyDefined()?20*this.getComponent(i.Cvss2Components.AC).value*this.getComponent(i.Cvss2Components.Au).value*this.getComponent(i.Cvss2Components.AV).value:0}calculateExactTemporalScore(){return this.isAnyTemporalDefined()?super.round(this.calculateExactBaseScore(),1)*this.getComponent(i.Cvss2Components.E).value*this.getComponent(i.Cvss2Components.RL).value*this.getComponent(i.Cvss2Components.RC).value:0}calculateExactAdjustedBaseScore(){let e=this.calculateExactAdjustedImpactScore(),t=this.calculateExactExploitabilityScore();return t=this.round(t,1),(.6*e+.4*t-1.5)*this.f(e)}calculateExactAdjustedTemporalScore(){return this.calculateExactAdjustedBaseScore()*this.getComponent(i.Cvss2Components.E).value*this.getComponent(i.Cvss2Components.RL).value*this.getComponent(i.Cvss2Components.RC).value}calculateExactEnvironmentalScore(){if(!this.isAnyEnvironmentalDefined())return 0;let e=this.calculateExactAdjustedTemporalScore();return(e+(10-e)*this.getComponent(i.Cvss2Components.CDP).value)*this.getComponent(i.Cvss2Components.TD).value}calculateExactAdjustedImpactScore(){if(!this.isAnyEnvironmentalDefined())return 0;let e=this.getComponent(i.Cvss2Components.C).value,t=this.getComponent(i.Cvss2Components.I).value,o=this.getComponent(i.Cvss2Components.A).value,a=this.getComponent(i.Cvss2Components.CR).value,s=this.getComponent(i.Cvss2Components.IR).value,n=this.getComponent(i.Cvss2Components.AR).value;return Math.min(10,10.41*(1-(1-e*a)*(1-t*s)*(1-o*n)))}calculateExactOverallScore(){return this.isAnyEnvironmentalDefined()?this.calculateExactEnvironmentalScore():this.isAnyTemporalDefined()?this.calculateExactTemporalScore():this.calculateExactBaseScore()}isBaseFullyDefined(){return super.isCategoryFullyDefined(i.Cvss2Components.BASE_CATEGORY)}isTemporalFullyDefined(){return super.isCategoryFullyDefined(i.Cvss2Components.TEMPORAL_CATEGORY)}isEnvironmentalFullyDefined(){return super.isCategoryFullyDefined(i.Cvss2Components.ENVIRONMENTAL_CATEGORY)}isAnyBaseDefined(){return super.isCategoryPartiallyDefined(i.Cvss2Components.BASE_CATEGORY)}isAnyTemporalDefined(){return super.isCategoryPartiallyDefined(i.Cvss2Components.TEMPORAL_CATEGORY)}isAnyEnvironmentalDefined(){return super.isCategoryPartiallyDefined(i.Cvss2Components.ENVIRONMENTAL_CATEGORY)}f(e){return 0===e?0:1.176}createJsonSchema(){const e=this.calculateScores();return{version:"2.0",vectorString:this.toString(),baseScore:e.base,temporalScore:e.temporal,environmentalScore:e.environmental,accessVector:this.getComponent(i.Cvss2Components.AV).jsonSchemaName,accessComplexity:this.getComponent(i.Cvss2Components.AC).jsonSchemaName,authentication:this.getComponent(i.Cvss2Components.Au).jsonSchemaName,confidentialityImpact:this.getComponent(i.Cvss2Components.C).jsonSchemaName,integrityImpact:this.getComponent(i.Cvss2Components.I).jsonSchemaName,availabilityImpact:this.getComponent(i.Cvss2Components.A).jsonSchemaName,exploitability:this.getComponent(i.Cvss2Components.E).jsonSchemaName,remediationLevel:this.getComponent(i.Cvss2Components.RL).jsonSchemaName,reportConfidence:this.getComponent(i.Cvss2Components.RC).jsonSchemaName,collateralDamagePotential:this.getComponent(i.Cvss2Components.CDP).jsonSchemaName,targetDistribution:this.getComponent(i.Cvss2Components.TD).jsonSchemaName,confidentialityRequirement:this.getComponent(i.Cvss2Components.CR).jsonSchemaName,integrityRequirement:this.getComponent(i.Cvss2Components.IR).jsonSchemaName,availabilityRequirement:this.getComponent(i.Cvss2Components.AR).jsonSchemaName}}}t.Cvss2=s},703:(e,t,o)=>{var a;Object.defineProperty(t,"__esModule",{value:!0}),t.Cvss2Components=void 0;const i=o(44);class s{}t.Cvss2Components=s,a=s,s.BASE_CATEGORY={name:"base",description:"Represents the intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments."},s.AV_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will result in no score being calculated."},L:{shortName:"L",value:.395,name:"Local",jsonSchemaName:"LOCAL",description:"A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account. Examples of locally exploitable vulnerabilities are peripheral attacks such as Firewire/USB DMA attacks, and local privilege escalations (e.g., sudo)."},A:{shortName:"A",value:.646,name:"Adjacent Network",abbreviatedName:"Adj. Network",jsonSchemaName:"ADJACENT_NETWORK",description:"A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software. Examples of local networks include local IP subnet, Bluetooth, IEEE 802.11, and local Ethernet segment."},N:{shortName:"N",value:1,name:"Network",jsonSchemaName:"NETWORK",description:'A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed "remotely exploitable". An example of a network attack is an RPC buffer overflow.'}},s.AV={name:"Access Vector",shortName:"AV",subCategory:"Exploitability Metrics",description:"This metric reflects how the vulnerability is exploited. The more remote an attacker can be to attack a host, the greater the vulnerability score.",values:[a.AV_VALUES.ND,a.AV_VALUES.L,a.AV_VALUES.A,a.AV_VALUES.N]},s.AC_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will result in no score being calculated."},H:{shortName:"H",value:.35,name:"High",jsonSchemaName:"HIGH",description:"Specialized access conditions exist. For example, an attacker can only exploit the vulnerability under very specialized conditions."},M:{shortName:"M",value:.61,name:"Medium",jsonSchemaName:"MEDIUM",description:"The access conditions are somewhat specialized. For example, the attacker can only exploit the vulnerability under certain conditions."},L:{shortName:"L",value:.71,name:"Low",jsonSchemaName:"LOW",description:"Specialized access conditions or extenuating circumstances do not exist. For example, an attacker can exploit the vulnerability under most conditions."}},s.AC={name:"Access Complexity",shortName:"AC",subCategory:"Exploitability Metrics",description:'This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: If the vulnerability is exploitable only once a user has been authenticated by the service, the vulnerability is only "Medium" complexity. If, however, the vulnerability can be exploited anonymously, it is "Low" complexity.',values:[a.AC_VALUES.ND,a.AC_VALUES.H,a.AC_VALUES.M,a.AC_VALUES.L]},s.Au_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will result in no score being calculated."},M:{shortName:"M",value:.45,name:"Multiple",jsonSchemaName:"MULTIPLE",description:"Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time. An example is an attacker authenticating to an operating system in addition to providing credentials to access an application hosted on that system."},S:{shortName:"S",value:.56,name:"Single",jsonSchemaName:"SINGLE",description:"The vulnerability requires an attacker to be logged into the system (such as at a command line or via a desktop session or web interface)."},N:{shortName:"N",value:.704,name:"None",jsonSchemaName:"NONE",description:"Authentication is not required to exploit the vulnerability."}},s.Au={name:"Authentication",shortName:"Au",subCategory:"Exploitability Metrics",description:'This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. "Multiple" means that the attacker must authenticate two or more times, "Single" means that the attacker must authenticate once, and "None" means that the attacker need not authenticate at all to exploit the vulnerability.',values:[a.Au_VALUES.ND,a.Au_VALUES.M,a.Au_VALUES.S,a.Au_VALUES.N]},s.C_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will result in no score being calculated."},N:{shortName:"N",value:0,name:"None",jsonSchemaName:"NONE",description:"There is no impact to the confidentiality of the system."},P:{shortName:"P",value:.275,name:"Partial",jsonSchemaName:"PARTIAL",description:"There is considerable informational disclosure. Access to some system files is possible, but the attacker does not have control over what is obtained, or the scope of the loss is constrained. An example is a vulnerability that divulges only certain tables in a database."},C:{shortName:"C",value:.66,name:"Complete",jsonSchemaName:"COMPLETE",description:"There is total information disclosure, resulting in all system files being revealed. The attacker is able to read all of the system's data (memory, files, etc.)"}},s.C={name:"Confidentiality Impact",shortName:"C",subCategory:"Impact Metrics",description:"This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.",values:[a.C_VALUES.ND,a.C_VALUES.N,a.C_VALUES.P,a.C_VALUES.C]},s.I_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will result in no score being calculated."},N:{shortName:"N",value:0,name:"None",jsonSchemaName:"NONE",description:"There is no impact to the integrity of the system."},P:{shortName:"P",value:.275,name:"Partial",jsonSchemaName:"PARTIAL",description:"Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited. For example, system or application files may be overwritten or modified, but either the attacker has no control over which files are affected or the attacker can modify files within only a limited context or scope."},C:{shortName:"C",value:.66,name:"Complete",jsonSchemaName:"COMPLETE",description:"There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised. The attacker is able to modify any files on the target system."}},s.I={name:"Integrity Impact",shortName:"I",subCategory:"Impact Metrics",description:"This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information.",values:[a.I_VALUES.ND,a.I_VALUES.N,a.I_VALUES.P,a.I_VALUES.C]},s.A_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will result in no score being calculated."},N:{shortName:"N",value:0,name:"None",jsonSchemaName:"NONE",description:"There is no impact to availability within the impacted component."},P:{shortName:"P",value:.275,name:"Partial",jsonSchemaName:"PARTIAL",description:"There is reduced performance or interruptions in resource availability. An example is a network-based flood attack that permits a limited number of successful connections to an Internet service."},C:{shortName:"C",value:.66,name:"Complete",jsonSchemaName:"COMPLETE",description:"There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable."}},s.A={name:"Availability Impact",shortName:"A",subCategory:"Impact Metrics",description:"This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the impacted component, this metric refers to the loss of availability of the impacted component itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of an impacted component. This metric considers only the availability of the impacted component itself.",values:[a.A_VALUES.ND,a.A_VALUES.N,a.A_VALUES.P,a.A_VALUES.C]},s.BASE_CATEGORY_VALUES=[a.AV,a.AC,a.Au,a.C,a.I,a.A],s.TEMPORAL_CATEGORY={name:"temporal",description:"The threat posed by a vulnerability may change over time. Three such factors that CVSS captures are: confirmation of the technical details of a vulnerability, the remediation status of the vulnerability, and the availability of exploit code or techniques. Since temporal metrics are optional they each include a metric value that has no effect on the score."},s.E_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric."},U:{shortName:"U",value:.85,name:"Unproven",jsonSchemaName:"UNPROVEN",description:"No exploit code is available, or an exploit is entirely theoretical."},POC:{shortName:"POC",value:.9,name:"Proof-of-concept",abbreviatedName:"Proof-of-conc.",jsonSchemaName:"PROOF_OF_CONCEPT",description:"Proof-of-concept exploit code or an attack demonstration that is not practical for most systems is available. The code or technique is not functional in all situations and may require substantial modification by a skilled attacker."},F:{shortName:"F",value:.95,name:"Functional",jsonSchemaName:"FUNCTIONAL",description:"Functional exploit code is available. The code works in most situations where the vulnerability exists."},H:{shortName:"H",value:1,name:"High",jsonSchemaName:"HIGH",description:"Either the vulnerability is exploitable by functional mobile autonomous code, or no exploit is required (manual trigger) and details are widely available. The code works in every situation, or is actively being delivered via a mobile autonomous agent (such as a worm or virus)."}},s.E={name:"Exploitability",shortName:"E",description:'This metric measures the current state of exploit techniques or code availability. "Unproven that exploit exists" is the lowest impact and "Proof-of-concept code" is the highest impact.',values:[a.E_VALUES.ND,a.E_VALUES.U,a.E_VALUES.POC,a.E_VALUES.F,a.E_VALUES.H]},s.RL_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric."},OF:{shortName:"OF",value:.87,name:"Official Fix",abbreviatedName:"Off. Fix",jsonSchemaName:"OFFICIAL_FIX",description:"A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available."},TF:{shortName:"TF",value:.9,name:"Temporary Fix",abbreviatedName:"Temp. Fix",jsonSchemaName:"TEMPORARY_FIX",description:"There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool, or workaround."},W:{shortName:"W",value:.95,name:"Workaround",jsonSchemaName:"WORKAROUND",description:"There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate the vulnerability."},U:{shortName:"U",value:1,name:"Unavailable",jsonSchemaName:"UNAVAILABLE",description:"There is either no solution available or it is impossible to apply."}},s.RL={name:"Remediation Level",shortName:"RL",description:'This metric measures the remediation level of a vulnerability. "Official fix" is the lowest impact and "Unavailable" is the highest impact.',values:[a.RL_VALUES.ND,a.RL_VALUES.OF,a.RL_VALUES.TF,a.RL_VALUES.W,a.RL_VALUES.U]},s.RC_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric."},UC:{shortName:"UC",value:.9,name:"Unconfirmed",jsonSchemaName:"UNCONFIRMED",description:"There is little confidence in the existence of this vulnerability. The report is unconfirmed, or the source is not known."},UR:{shortName:"UR",value:.95,name:"Uncorroborated",jsonSchemaName:"UNCORROBORATED",description:"There is reasonable confidence in the existence of this vulnerability, but the technical details are not known publicly. The report is unconfirmed."},C:{shortName:"C",value:1,name:"Confirmed",jsonSchemaName:"CONFIRMED",description:"The existence of this vulnerability is confirmed, but the details are not known publicly. An exploit has been observed, or proof-of-concept exploit code is available. The bugtraq ID or CVE ID has been made public."}},s.RC={name:"Report Confidence",shortName:"RC",description:'This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. "Unconfirmed" is the lowest confidence and "Confirmed" is the highest.',values:[a.RC_VALUES.ND,a.RC_VALUES.UC,a.RC_VALUES.UR,a.RC_VALUES.C]},s.TEMPORAL_CATEGORY_VALUES=[a.E,a.RL,a.RC],s.ENVIRONMENTAL_CATEGORY={name:"environmental",description:"Different environments can have an immense bearing on the risk that a vulnerability poses to an organization and its stakeholders. The CVSS environmental metric group captures the characteristics of a vulnerability that are associated with a user's IT environment. Since environmental metrics are optional they each include a metric value that has no effect on the score."},s.CDP_VALUES={ND:{shortName:"ND",value:0,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric."},N:{shortName:"N",value:0,name:"None",jsonSchemaName:"NONE",description:"There is no potential for loss of life, physical assets, productivity or revenue."},L:{shortName:"L",value:.1,name:"Low",jsonSchemaName:"LOW",description:"A successful exploit of this vulnerability may result in slight physical or property damage. Or, there may be a slight loss of revenue or productivity to the organization."},LM:{shortName:"LM",value:.3,name:"Low-Medium",abbreviatedName:"Low-Med.",jsonSchemaName:"LOW_MEDIUM",description:"A successful exploit of this vulnerability may result in moderate physical or property damage. Or, there may be a moderate loss of revenue or productivity to the organization."},MH:{shortName:"MH",value:.4,name:"Medium-High",abbreviatedName:"Med.-High",jsonSchemaName:"MEDIUM_HIGH",description:"A successful exploit of this vulnerability may result in significant physical or property damage or loss. Or, there may be a significant loss of revenue or productivity."},H:{shortName:"H",value:.5,name:"High",jsonSchemaName:"HIGH",description:"A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. Or, there may be a catastrophic loss of revenue or productivity."}},s.CDP={name:"Collateral Damage Potential",shortName:"CDP",subCategory:"General Modifiers",description:'This metric measures the potential for loss of life or physical assets resulting from a vulnerability. "None" is the lowest impact and "High" is the highest impact.',values:[a.CDP_VALUES.ND,a.CDP_VALUES.N,a.CDP_VALUES.L,a.CDP_VALUES.LM,a.CDP_VALUES.MH,a.CDP_VALUES.H]},s.TD_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric."},N:{shortName:"N",value:0,name:"None",jsonSchemaName:"NONE",description:"There is no (0%) target distribution."},L:{shortName:"L",value:.25,name:"Low",jsonSchemaName:"LOW",description:"There is a small (< 25%) target distribution."},M:{shortName:"M",value:.75,name:"Medium",jsonSchemaName:"MEDIUM",description:"There is a medium (26-75%) target distribution."},H:{shortName:"H",value:1,name:"High",description:"There is a high (> 75%) target distribution."}},s.TD={name:"Target Distribution",shortName:"TD",subCategory:"General Modifiers",description:'This metric measures the proportion of vulnerable systems that could be affected by an attack. It is meant to represent the proportion of vulnerable systems that an attacker can expect to target. "None" is the lowest impact and "High" is the highest impact.',values:[a.TD_VALUES.ND,a.TD_VALUES.N,a.TD_VALUES.L,a.TD_VALUES.M,a.TD_VALUES.H]},s.CR_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric."},L:{shortName:"L",value:.5,name:"Low",jsonSchemaName:"LOW",description:"Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."},M:{shortName:"M",value:1,name:"Medium",jsonSchemaName:"MEDIUM",description:"Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."},H:{shortName:"H",value:1.51,name:"High",jsonSchemaName:"HIGH",description:"Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."}},s.CR={name:"Confidentiality Requirement",shortName:"CR",subCategory:"Modified Requirement (Impact Subscore) Modifiers",description:'This metric measures the need for confidentiality of the vulnerable component to the user. For example, an attacker that exploits a vulnerability that exists on a network boundary and requires no privileges has a low need for the confidentiality of the vulnerable component. Conversely, an attacker that exploits a vulnerability that exists on the same system as the vulnerable component and requires Privileged access to the system in order to exploit it has a high need for confidentiality. "Not Defined" is the lowest impact and "High" is the highest impact.',values:[a.CR_VALUES.ND,a.CR_VALUES.L,a.CR_VALUES.M,a.CR_VALUES.H]},s.IR_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric."},L:{shortName:"L",value:.5,name:"Low",jsonSchemaName:"LOW",description:"Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."},M:{shortName:"M",value:1,name:"Medium",jsonSchemaName:"MEDIUM",description:"Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."},H:{shortName:"H",value:1.51,name:"High",jsonSchemaName:"HIGH",description:"Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."}},s.IR={name:"Integrity Requirement",shortName:"IR",subCategory:"Modified Requirement (Impact Subscore) Modifiers",description:'This metric measures the need for integrity of the vulnerable component to a user. For example, an attacker that exploits a vulnerability that exists on a network boundary and requires no privileges has a low need for the integrity of the vulnerable component. Conversely, an attacker that exploits a vulnerability that exists on the same system as the vulnerable component and requires Privileged access to the system in order to exploit it has a high need for integrity. "Not Defined" is the lowest impact and "High" is the highest impact.',values:[a.IR_VALUES.ND,a.IR_VALUES.L,a.IR_VALUES.M,a.IR_VALUES.H]},s.AR_VALUES={ND:{shortName:"ND",value:1,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric."},L:{shortName:"L",value:.5,name:"Low",jsonSchemaName:"LOW",description:"Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."},M:{shortName:"M",value:1,name:"Medium",jsonSchemaName:"MEDIUM",description:"Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."},H:{shortName:"H",value:1.51,name:"High",jsonSchemaName:"HIGH",description:"Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)."}},s.AR={name:"Availability Requirement",shortName:"AR",subCategory:"Modified Requirement (Impact Subscore) Modifiers",description:'This metric measures the need for availability of the vulnerable component to a user. For example, an attacker that exploits a vulnerability that exists on a network boundary and requires no privileges has a low need for the availability of the vulnerable component. Conversely, an attacker that exploits a vulnerability that exists on the same system as the vulnerable component and requires Privileged access to the system in order to exploit it has a high need for availability. "Not Defined" is the lowest impact and "High" is the highest impact.',values:[a.AR_VALUES.ND,a.AR_VALUES.L,a.AR_VALUES.M,a.AR_VALUES.H]},s.ENVIRONMENTAL_CATEGORY_VALUES=[a.CDP,a.TD,a.CR,a.IR,a.AR],s.REGISTERED_COMPONENTS=new Map,a.REGISTERED_COMPONENTS.set(a.BASE_CATEGORY,a.BASE_CATEGORY_VALUES),a.REGISTERED_COMPONENTS.set(a.TEMPORAL_CATEGORY,a.TEMPORAL_CATEGORY_VALUES),a.REGISTERED_COMPONENTS.set(a.ENVIRONMENTAL_CATEGORY,a.ENVIRONMENTAL_CATEGORY_VALUES),s.ATTRIBUTE_SEVERITY_ORDER=i.CvssVector._reorderAttributeSeverityOrder([a.AC_VALUES.ND,a.AV_VALUES.ND,a.Au_VALUES.ND,a.C_VALUES.ND,a.I_VALUES.ND,a.A_VALUES.ND,a.C_VALUES.N,a.I_VALUES.N,a.A_VALUES.N,a.CDP_VALUES.N,a.CDP_VALUES.ND,a.TD_VALUES.N,a.CDP_VALUES.L,a.TD_VALUES.L,a.C_VALUES.P,a.I_VALUES.P,a.A_VALUES.P,a.CDP_VALUES.LM,a.AC_VALUES.H,a.AV_VALUES.L,a.CDP_VALUES.MH,a.Au_VALUES.M,a.CDP_VALUES.H,a.Au_VALUES.S,a.AC_VALUES.M,a.AV_VALUES.A,a.C_VALUES.C,a.I_VALUES.C,a.A_VALUES.C,a.Au_VALUES.N,a.AC_VALUES.L,a.TD_VALUES.M,a.E_VALUES.U,a.RL_VALUES.OF,a.E_VALUES.POC,a.RL_VALUES.TF,a.RL_VALUES.W,a.RC_VALUES.UC,a.AV_VALUES.N,a.E_VALUES.F,a.E_VALUES.H,a.E_VALUES.ND,a.RL_VALUES.U,a.RL_VALUES.ND,a.RC_VALUES.UR,a.RC_VALUES.C,a.RC_VALUES.ND,a.TD_VALUES.H,a.TD_VALUES.ND,a.CR_VALUES.L,a.CR_VALUES.M,a.IR_VALUES.L,a.IR_VALUES.M,a.AR_VALUES.L,a.AR_VALUES.M,a.CR_VALUES.ND,a.IR_VALUES.ND,a.AR_VALUES.ND,a.CR_VALUES.H,a.IR_VALUES.H,a.AR_VALUES.H])},500:(e,t,o)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.Cvss3P0=void 0;const a=o(44),i=o(431);class s extends a.CvssVector{constructor(e){super(e)}getRegisteredComponents(){return i.Cvss3P0Components.REGISTERED_COMPONENTS}getVectorPrefix(){return"CVSS:3.0/"}getVectorName(){return"CVSS:3.0"}fillAverageVector(){this.applyVector("AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L")}fillRandomBaseVector(){this.fillRandomComponentsForCategory(i.Cvss3P0Components.BASE_CATEGORY)}fillRandomTemporalVector(){this.fillRandomComponentsForCategory(i.Cvss3P0Components.TEMPORAL_CATEGORY)}fillRandomEnvironmentalVector(){this.fillRandomComponentsForCategory(i.Cvss3P0Components.ENVIRONMENTAL_CATEGORY)}fillRandomComponentsForCategory(e){const t=i.Cvss3P0Components.REGISTERED_COMPONENTS.get(e);if(t)for(let e=0;e<t.length;e++){const o=t[e],a=super.pickRandomDefinedComponentValue(o);if(!a)return console.warn("Failed to pick random vector component for",o),void this.fillAverageVector();this.applyComponent(o,a)}else console.warn("Failed to pick random vector components for",e)}calculateScoresInternal(e=!1){const t=this.isBaseFullyDefined(),o=this.isAnyTemporalDefined(),a=this.isAnyEnvironmentalDefined();return{normalized:e,base:t?super.round(this.calculateExactBaseScore(),1):void 0,impact:t?super.normalizeScore(super.round(this.calculateImpactScore(),1),e?6:10):void 0,exploitability:t?super.normalizeScore(super.round(this.calculateExactExploitabilityScore(),1),e?3.9:10):void 0,temporal:t&&o?super.round(this.calculateExactTemporalScore(),1):void 0,environmental:t&&a?super.round(this.calculateExactEnvironmentalScore(),1):void 0,modifiedImpact:t&&a?super.normalizeScore(super.round(Math.max(0,this.calculateExactAdjustedImpactScore()),1),e?6.1:10):void 0,overall:super.round(this.calculateExactOverallScore(),1),vector:this.toString()}}calculateExactBaseScore(){if(!this.isBaseFullyDefined())return 0;let e=this.calculateExactImpactScore();if(e<=0)return 0;let t=this.calculateExactExploitabilityScore();return this.getComponent(i.Cvss3P0Components.S).value?this.roundUp1(Math.min(s.SCOPE_COEFFICIENT*(e+t),10)):this.roundUp1(Math.min(e+t,10))}calculateImpactScore(){const e=this.calculateExactImpactScore();return e<=0?0:e}calculateExactImpactScore(){let e=this.calculateExactISSScore();return this.getComponent(i.Cvss3P0Components.S).value?s.SCOPE_CHANGED_FACTOR*(e-.029)-3.25*Math.pow(e-.02,15):s.SCOPE_UNCHANGED_FACTOR*e}calculateExactISSScore(){return 1-(1-this.getComponent(i.Cvss3P0Components.C).value)*(1-this.getComponent(i.Cvss3P0Components.I).value)*(1-this.getComponent(i.Cvss3P0Components.A).value)}calculateExactMISSScore(){let e,t,o,a,s,n,r=this.getComponent(i.Cvss3P0Components.MC),c=this.getComponent(i.Cvss3P0Components.MI),l=this.getComponent(i.Cvss3P0Components.MA),m=this.getComponent(i.Cvss3P0Components.C),h=this.getComponent(i.Cvss3P0Components.I),E=this.getComponent(i.Cvss3P0Components.A),u=this.getComponent(i.Cvss3P0Components.CR),d=this.getComponent(i.Cvss3P0Components.IR),p=this.getComponent(i.Cvss3P0Components.AR);return e=r===i.Cvss3P0Components.MC.values[0]?m.value:r.value,t=c===i.Cvss3P0Components.MI.values[0]?h.value:c.value,o=l===i.Cvss3P0Components.MA.values[0]?E.value:l.value,i.Cvss3P0Components.CR.values[0],a=u.value,i.Cvss3P0Components.IR.values[0],s=d.value,i.Cvss3P0Components.AR.values[0],n=p.value,Math.min(1-(1-a*e)*(1-s*t)*(1-n*o),.915)}calculateExactExploitabilityScore(){const e=this.getComponent(i.Cvss3P0Components.AV).value,t=this.getComponent(i.Cvss3P0Components.AC).value,o=this.getComponent(i.Cvss3P0Components.UI).value;let a;return a=this.getComponent(i.Cvss3P0Components.S).value?this.getComponent(i.Cvss3P0Components.PR).changedValue:this.getComponent(i.Cvss3P0Components.PR).value,s.EXPLOITABILITY_COEFFICIENT*e*t*a*o}calculateExactTemporalScore(){if(!this.isBaseFullyDefined())return 0;if(!this.isAnyTemporalDefined())return 0;let e=this.getComponent(i.Cvss3P0Components.E).value,t=this.getComponent(i.Cvss3P0Components.RL).value,o=this.getComponent(i.Cvss3P0Components.RC).value,a=this.calculateExactBaseScore();return this.roundUp1(a*e*t*o)}calculateExactEnvironmentalScore(){if(!this.isBaseFullyDefined())return 0;if(!this.isAnyEnvironmentalDefined())return 0;let e=this.calculateExactAdjustedImpactScore();if(e<=0)return 0;let t=this.calculateAdjustedExploitability(),o=this.getComponent(i.Cvss3P0Components.E).value,a=this.getComponent(i.Cvss3P0Components.RL).value,n=this.getComponent(i.Cvss3P0Components.RC).value;if(this.isModifiedScope()){let i=this.roundUp1(Math.min(e+t,10));return this.roundUp1(i*o*a*n)}{let i=this.roundUp1(Math.min(s.SCOPE_COEFFICIENT*(e+t),10));return this.roundUp1(i*o*a*n)}}calculateExactAdjustedImpactScore(){if(!this.isBaseFullyDefined())return 0;if(!this.isAnyEnvironmentalDefined())return 0;let e=this.calculateExactMISSScore();return this.isModifiedScope()?s.SCOPE_UNCHANGED_FACTOR*e:s.SCOPE_CHANGED_FACTOR*(e-.029)-3.25*Math.pow(e-.02,15)}calculateAdjustedExploitability(){let e,t=this.getFirstDefinedComponent([i.Cvss3P0Components.MAV,i.Cvss3P0Components.AV]).value,o=this.getFirstDefinedComponent([i.Cvss3P0Components.MAC,i.Cvss3P0Components.AC]).value,a=this.getFirstDefinedComponent([i.Cvss3P0Components.MUI,i.Cvss3P0Components.UI]).value,n=this.getFirstDefinedComponent([i.Cvss3P0Components.MPR,i.Cvss3P0Components.PR]);return e=this.isModifiedScope()?n.value:n.changedValue,s.EXPLOITABILITY_COEFFICIENT*t*o*e*a}isModifiedScope(){let e=this.getComponent(i.Cvss3P0Components.S),t=this.getComponent(i.Cvss3P0Components.MS);return t===i.Cvss3P0Components.MS.values[0]?!e.value:!t.value}calculateExactOverallScore(){return this.isAnyEnvironmentalDefined()?this.calculateExactEnvironmentalScore():this.isAnyTemporalDefined()?this.calculateExactTemporalScore():this.calculateExactBaseScore()}isBaseFullyDefined(){return super.isCategoryFullyDefined(i.Cvss3P0Components.BASE_CATEGORY)}isTemporalFullyDefined(){return super.isCategoryFullyDefined(i.Cvss3P0Components.TEMPORAL_CATEGORY)}isEnvironmentalFullyDefined(){return super.isCategoryFullyDefined(i.Cvss3P0Components.ENVIRONMENTAL_CATEGORY)}isAnyBaseDefined(){return super.isCategoryPartiallyDefined(i.Cvss3P0Components.BASE_CATEGORY)}isAnyTemporalDefined(){return super.isCategoryPartiallyDefined(i.Cvss3P0Components.TEMPORAL_CATEGORY)}isAnyEnvironmentalDefined(){return super.isCategoryPartiallyDefined(i.Cvss3P0Components.ENVIRONMENTAL_CATEGORY)}roundUp1(e){return Math.ceil(10*e)/10}getJsonSchemaSeverity(e){return 0===e||isNaN(e)?"NONE":e<=3.9?"LOW":e<=6.9?"MEDIUM":e<=8.9?"HIGH":"CRITICAL"}createJsonSchema(){const e=this.calculateScores();return{version:"3.0",vectorString:this.toString(),baseScore:e.base,temporalScore:e.temporal,environmentalScore:e.environmental,baseSeverity:this.getJsonSchemaSeverity(e.base),temporalSeverity:e.temporal?this.getJsonSchemaSeverity(e.temporal):void 0,environmentalSeverity:e.environmental?this.getJsonSchemaSeverity(e.environmental):void 0,attackVector:this.getComponent(i.Cvss3P0Components.AV).jsonSchemaName,attackComplexity:this.getComponent(i.Cvss3P0Components.AC).jsonSchemaName,privilegesRequired:this.getComponent(i.Cvss3P0Components.PR).jsonSchemaName,userInteraction:this.getComponent(i.Cvss3P0Components.UI).jsonSchemaName,scope:this.getComponent(i.Cvss3P0Components.S).jsonSchemaName,confidentialityImpact:this.getComponent(i.Cvss3P0Components.C).jsonSchemaName,integrityImpact:this.getComponent(i.Cvss3P0Components.I).jsonSchemaName,availabilityImpact:this.getComponent(i.Cvss3P0Components.A).jsonSchemaName,exploitCodeMaturity:this.getComponent(i.Cvss3P0Components.E).jsonSchemaName,remediationLevel:this.getComponent(i.Cvss3P0Components.RL).jsonSchemaName,reportConfidence:this.getComponent(i.Cvss3P0Components.RC).jsonSchemaName,confidentialityRequirement:this.getComponent(i.Cvss3P0Components.CR).jsonSchemaName,integrityRequirement:this.getComponent(i.Cvss3P0Components.IR).jsonSchemaName,availabilityRequirement:this.getComponent(i.Cvss3P0Components.AR).jsonSchemaName,modifiedAttackVector:this.getComponent(i.Cvss3P0Components.MAV).jsonSchemaName,modifiedAttackComplexity:this.getComponent(i.Cvss3P0Components.MAC).jsonSchemaName,modifiedPrivilegesRequired:this.getComponent(i.Cvss3P0Components.MPR).jsonSchemaName,modifiedUserInteraction:this.getComponent(i.Cvss3P0Components.MUI).jsonSchemaName,modifiedScope:this.getComponent(i.Cvss3P0Components.MS).jsonSchemaName,modifiedConfidentialityImpact:this.getComponent(i.Cvss3P0Components.MC).jsonSchemaName,modifiedIntegrityImpact:this.getComponent(i.Cvss3P0Components.MI).jsonSchemaName,modifiedAvailabilityImpact:this.getComponent(i.Cvss3P0Components.MA).jsonSchemaName}}}t.Cvss3P0=s,s.SCOPE_CHANGED_FACTOR=7.52,s.SCOPE_UNCHANGED_FACTOR=6.42,s.EXPLOITABILITY_COEFFICIENT=8.22,s.SCOPE_COEFFICIENT=1.08},431:(e,t)=>{var o;Object.defineProperty(t,"__esModule",{value:!0}),t.Cvss3P0Components=void 0;class a{}t.Cvss3P0Components=a,o=a,a.CONFIDENTIALITY_IMPACT_VALUES={X:{shortName:"X",value:0,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Component is not defined."},N:{shortName:"N",value:0,name:"None",jsonSchemaName:"NONE",description:"There is no loss of confidentiality within the impacted component."},L:{shortName:"L",value:.22,name:"Low",jsonSchemaName:"LOW",description:"There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component."},H:{shortName:"H",value:.56,name:"High",jsonSchemaName:"HIGH",description:"There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server."}},a.CONFIDENTIALITY_IMPACT=[o.CONFIDENTIALITY_IMPACT_VALUES.X,o.CONFIDENTIALITY_IMPACT_VALUES.N,o.CONFIDENTIALITY_IMPACT_VALUES.L,o.CONFIDENTIALITY_IMPACT_VALUES.H],a.INTEGRITY_IMPACT_VALUES={X:{shortName:"X",value:0,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Component is not defined."},N:{shortName:"N",value:0,name:"None",jsonSchemaName:"NONE",description:"There is no loss of integrity within the impacted component."},L:{shortName:"L",value:.22,name:"Low",jsonSchemaName:"LOW",description:"Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component."},H:{shortName:"H",value:.56,name:"High",jsonSchemaName:"HIGH",description:"There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component."}},a.INTEGRITY_IMPACT=[o.INTEGRITY_IMPACT_VALUES.X,o.INTEGRITY_IMPACT_VALUES.N,o.INTEGRITY_IMPACT_VALUES.L,o.INTEGRITY_IMPACT_VALUES.H],a.AVAILABILITY_IMPACT_VALUES={X:{shortName:"X",value:0,name:"Not Defined",abbreviatedName:"Not Def.",jsonSchemaName:"NOT_DEFINED",description:"Component is not defined."},N:{shortName:"N",value:0,name:"None",jsonSchemaName:"NONE",description:"There is no impact to availability within the impacted component."},L:{shortName:"L",value:.22,name:"Low",jsonSchemaName:"LOW",description:"Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serio