CVSS

Data Structures

struct  cvss_entry
 Struct holding CVSS entry data. More...

Files

file  cvss.h
 

Interface to Common Vulnerability Scoring System Version 2.


Enumerations

enum  cvss_access_vector_t { AV_LOCAL, AV_ADJACENT_NETWORK, AV_NETWORK }
 

Access Vector.

More...
enum  cvss_access_complexity_t { AC_HIGH, AC_MEDIUM, AC_LOW }
 

Access Complexity.

More...
enum  cvss_authentication_t { AU_NONE, AU_SINGLE_INSTANCE, AU_MULTIPLE_INSTANCE }
 

Authentication.

More...
enum  cvss_conf_impact_t { CI_NONE, CI_PARTIAL, CI_COMPLETE }
 

Confidentiality Impact.

More...
enum  cvss_integ_impact_t { II_NONE, II_PARTIAL, II_COMPLETE }
 

Integrity Impact.

More...
enum  cvss_avail_impact_t { AI_NONE, AI_PARTIAL, AI_COMPLETE }
 

Availability Impact.

More...
enum  cvss_exploitability_t {
  EX_UNPROVEN, EX_PROOF_OF_CONCEPT, EX_FUNCTIONAL, EX_HIGH,
  EX_NOT_DEFINED
}
 

Exploitability.

More...
enum  cvss_remediation_level_t {
  RL_OFFICIAL_FIX, RL_TEMPORARY_FIX, RL_WORKAROUND, RL_UNAVAILABLE,
  RL_NOT_DEFINED
}
 

Remediation Level.

More...
enum  cvss_report_confidence_t { RC_UNCONFIRMED, RC_UNCORROBORATED, RC_CONFIRMED, RC_NOT_DEFINED }
 

Report Confidence.

More...
enum  cvss_collateral_damage_potential_t {
  CD_NONE, CD_LOW, CD_LOW_MEDIUM, CD_MEDIUM_HIGH,
  CD_HIGH, CD_NOT_DEFINED
}
 

Collateral Damage Potential.

More...
enum  cvss_target_distribution_t {
  TD_NONE, TD_LOW, TD_MEDIUM, TD_HIGH,
  TD_NOT_DEFINED
}
 

Target Distribution.

More...
enum  cvss_conf_req_t { CR_LOW, CR_MEDIUM, CR_HIGH, CR_NOT_DEFINED }
 

Confidentiality Requirement.

More...
enum  cvss_integ_req_t { IR_LOW, IR_MEDIUM, IR_HIGH, IR_NOT_DEFINED }
 

Integrity Requirement.

More...
enum  cvss_avail_req_t { AR_LOW, AR_MEDIUM, AR_HIGH, AR_NOT_DEFINED }
 

Availabublity Requirement.

More...

Functions

struct cvss_entrycvss_entry::cvss_entry_new (void)
 New CVSS entry.
void cvss_entry::cvss_entry_free (struct cvss_entry *entry)
 Free CVSS entry.

Evaluators



int cvss_base_score (cvss_access_vector_t ave, cvss_access_complexity_t ace, cvss_authentication_t aue, cvss_conf_impact_t cie, cvss_integ_impact_t iie, cvss_avail_impact_t aie, double *base_score, double *impact_score, double *exploitability_score)
int cvss_temp_score (cvss_exploitability_t exe, cvss_remediation_level_t rle, cvss_report_confidence_t rce, double base_score, double *temporal_score)
int cvss_env_score (cvss_collateral_damage_potential_t cde, cvss_target_distribution_t tde, cvss_conf_req_t cre, cvss_integ_req_t ire, cvss_avail_req_t are, cvss_access_vector_t ave, cvss_access_complexity_t ace, cvss_authentication_t aue, cvss_conf_impact_t cie, cvss_integ_impact_t iie, cvss_avail_impact_t aie, cvss_exploitability_t exe, cvss_remediation_level_t rle, cvss_report_confidence_t rce, double *enviromental_score)
int cvss_base_score_struct (const struct cvss_entry *entry, double *base_score, double *impact_score, double *exploitability_score)
 Get Base score of CVSS entry.
const char * cvss_entry::cvss_model_supported (void)
 Get supported version of CVSS XML.

Getters

Return value is pointer to structure's member.

Do not free unless you null the pointer in the structure. Use remove function otherwise.



const char * cvss_entry::cvss_entry_get_score (const struct cvss_entry *entry)
 Get score from CVSS entry.
const char * cvss_entry::cvss_entry_get_AV (const struct cvss_entry *entry)
 Get access vector from CVSS entry.
const char * cvss_entry::cvss_entry_get_AC (const struct cvss_entry *entry)
 Get access complexity from CVSS entry.
const char * cvss_entry::cvss_entry_get_authentication (const struct cvss_entry *entry)
 Get authentication from CVSS entry.
const char * cvss_entry::cvss_entry_get_imp_confidentiality (const struct cvss_entry *entry)
 Get confidentiality impact from CVSS entry.
const char * cvss_entry::cvss_entry_get_imp_integrity (const struct cvss_entry *entry)
 Get integrity impact from CVSS entry.
const char * cvss_entry::cvss_entry_get_imp_availability (const struct cvss_entry *entry)
 Get availability impact from CVSS entry.
const char * cvss_entry::cvss_entry_get_source (const struct cvss_entry *entry)
 Get source from CVSS entry.
const char * cvss_entry::cvss_entry_get_generated (const struct cvss_entry *entry)
 Get generated date-time from CVSS entry.

Setters

For lists use add functions.

Parameters of set functions are duplicated in memory and need to be freed by caller.



bool cvss_entry::cvss_entry_set_score (struct cvss_entry *entry, const char *new_score)
 Set of CVSS entry.
bool cvss_entry::cvss_entry_set_AV (struct cvss_entry *entry, const char *new_AV)
 Set access vector of CVSS entry.
bool cvss_entry::cvss_entry_set_AC (struct cvss_entry *entry, const char *new_AC)
 Set access complexity of CVSS entry.
bool cvss_entry::cvss_entry_set_authentication (struct cvss_entry *entry, const char *new_authentication)
 Set authentication of CVSS entry.
bool cvss_entry::cvss_entry_set_imp_confidentiality (struct cvss_entry *entry, const char *new_item)
 Set confidentiality impact of CVSS entry.
bool cvss_entry::cvss_entry_set_imp_integrity (struct cvss_entry *entry, const char *new_item)
 Set integrity impact of CVSS entry.
bool cvss_entry::cvss_entry_set_imp_availability (struct cvss_entry *entry, const char *new_item)
 Set availability impact of CVSS entry.
bool cvss_entry::cvss_entry_set_source (struct cvss_entry *entry, const char *new_source)
 Set source of CVSS entry.
bool cvss_entry::cvss_entry_set_generated (struct cvss_entry *entry, const char *new_generated)
 Set generated date-time of CVSS entry.

Enumeration Type Documentation

Access Complexity.

This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.

Access Vector.

This metric reflects how the vulnerability is exploited.

Enumerator:
AV_LOCAL 

requires local access

AV_ADJACENT_NETWORK 

adjacent network accessible

AV_NETWORK 

network accessible

Authentication.

This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.

Enumerator:
AU_NONE 

requires multiple authentication instances

AU_SINGLE_INSTANCE 

requires single instance of authentication

AU_MULTIPLE_INSTANCE 

requires no authentication

Availability Impact.

This metric measures the impact to availability of a successfully exploited vulnerability.

Availabublity Requirement.

This metric enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in term of availability.

Collateral Damage Potential.

This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment.

Confidentiality Impact.

This metric measures the impact on confidentiality of a successfully exploited vulnerability.

Confidentiality Requirement.

This metric enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in term of confidentiality.

Exploitability.

This metric measures the current state of exploit techniques or code availability.

Integrity Impact.

This metric measures the impact to integrity of a successfully exploited vulnerability.

Integrity Requirement.

This metric enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in term of integrity.

Remediation Level.

The remediation level of a vulnerability is an important factor for prioritization.

Report Confidence.

This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.

Target Distribution.

This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability.


Function Documentation

int cvss_base_score_struct ( const struct cvss_entry entry,
double *  base_score,
double *  impact_score,
double *  exploitability_score 
)

Get Base score of CVSS entry.

Returns:
0 if everything done
void cvss_entry_free ( struct cvss_entry entry  )  [inherited]

Free CVSS entry.

Parameters:
entry CVSS entry
const char * cvss_entry_get_AC ( const struct cvss_entry entry  )  [inherited]

Get access complexity from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS access complexity
const char * cvss_entry_get_authentication ( const struct cvss_entry entry  )  [inherited]

Get authentication from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS authentication
const char * cvss_entry_get_AV ( const struct cvss_entry entry  )  [inherited]

Get access vector from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS access vector
const char * cvss_entry_get_generated ( const struct cvss_entry entry  )  [inherited]

Get generated date-time from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS generated date-time
const char * cvss_entry_get_imp_availability ( const struct cvss_entry entry  )  [inherited]

Get availability impact from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS availability impact
const char * cvss_entry_get_imp_confidentiality ( const struct cvss_entry entry  )  [inherited]

Get confidentiality impact from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS conidentiality impact
const char * cvss_entry_get_imp_integrity ( const struct cvss_entry entry  )  [inherited]

Get integrity impact from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS integrity impact
const char * cvss_entry_get_score ( const struct cvss_entry entry  )  [inherited]

Get score from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS score
const char * cvss_entry_get_source ( const struct cvss_entry entry  )  [inherited]

Get source from CVSS entry.

Parameters:
entry CVSS entry
Returns:
CVSS source
struct cvss_entry * cvss_entry_new ( void   )  [read, inherited]

New CVSS entry.

Returns:
new cvss_entry
bool cvss_entry_set_AC ( struct cvss_entry entry,
const char *  new_AC 
) [inherited]

Set access complexity of CVSS entry.

Parameters:
entry CVSS entry
new_AC new access complexity of CVSS
Returns:
true if set, false otherwise
bool cvss_entry_set_authentication ( struct cvss_entry entry,
const char *  new_authentication 
) [inherited]

Set authentication of CVSS entry.

Parameters:
entry CVSS entry
new_authentication new authentication of CVSS
Returns:
true if set, false otherwise
bool cvss_entry_set_AV ( struct cvss_entry entry,
const char *  new_AV 
) [inherited]

Set access vector of CVSS entry.

Parameters:
entry CVSS entry
new_AV new access vector of CVSS
Returns:
true if set, false otherwise
bool cvss_entry_set_generated ( struct cvss_entry entry,
const char *  new_generated 
) [inherited]

Set generated date-time of CVSS entry.

Parameters:
entry CVSS entry
new_generated new generated date-time of CVSS
Returns:
true if set, false otherwise
bool cvss_entry_set_imp_availability ( struct cvss_entry entry,
const char *  new_item 
) [inherited]

Set availability impact of CVSS entry.

Parameters:
entry CVSS entry
new_item new impact of CVSS
Returns:
true if set, false otherwise
bool cvss_entry_set_imp_confidentiality ( struct cvss_entry entry,
const char *  new_item 
) [inherited]

Set confidentiality impact of CVSS entry.

Parameters:
entry CVSS entry
new_item new impact of CVSS
Returns:
true if set, false otherwise
bool cvss_entry_set_imp_integrity ( struct cvss_entry entry,
const char *  new_item 
) [inherited]

Set integrity impact of CVSS entry.

Parameters:
entry CVSS entry
new_item new impact of CVSS
Returns:
true if set, false otherwise
bool cvss_entry_set_score ( struct cvss_entry entry,
const char *  new_score 
) [inherited]

Set of CVSS entry.

Parameters:
entry CVSS entry
new_ new of CVSS
Returns:
true if set, false otherwise
bool cvss_entry_set_source ( struct cvss_entry entry,
const char *  new_source 
) [inherited]

Set source of CVSS entry.

Parameters:
entry CVSS entry
new_ new of CVSS
Returns:
true if set, false otherwise
const char * cvss_model_supported ( void   )  [inherited]

Get supported version of CVSS XML.

Returns:
version of XML file format

Generated on 14 Jul 2010 for Open SCAP Library by  doxygen 1.6.1