helpers/helper.rb
# CVSS helper, there is a lot of hardcoded stuff
CVSS helper, there is a lot of hardcoded stuff
CVSS helper there is a lot of hardcoded stuff
def cvss(data)
	av = data["av2"]
	ac = data["ac2"]
	au = data["au2"]
	c = data["c2"]
	i = data["i2"]
	a = data["a2"]
	e = data["e2"]
	rl = data["rl2"]
	rc = data["rc2"]
	cdp = data["cdp"]
	td = data["td"]
	cr = data["cr2"]
	ir = data["ir2"]
	ar = data["ar2"]
	if ac == "High"
	    cvss_ac = 0.35
	elsif ac == "Medium"
	    cvss_ac = 0.61
	else
	    cvss_ac = 0.71
	end
	if au == "None"
	    cvss_au = 0.704
	elsif au == "Single"
	    cvss_au = 0.56
	else
	    cvss_au = 0.45
	end
	if av == "Local"
	    cvss_av = 0.395
	elsif av == "Local Network"
	    cvss_av = 0.646
	else
	    cvss_av = 1
	end
	if c == "None"
	    cvss_c = 0
	elsif c == "Partial"
	    cvss_c = 0.275
	else
	    cvss_c = 0.660
	end
	if i == "None"
	    cvss_i = 00
	elsif i == "Partial"
	    cvss_i = 0.275
	else
	    cvss_i = 0.660
	end
	if a == "None"
	    cvss_a = 0
	elsif a == "Partial"
	    cvss_a = 0.275
	else
	    cvss_a = 0.660
	end
	if e == "Unproven Exploit Exists"
	    cvss_e = 0.85
	elsif e == "Proof-of-Concept Code"
	    cvss_e = 0.90
	elsif e == "Functional Exploit Exists"
	    cvss_e = 0.95
	else
	    cvss_e = 1
	end
	if rl == "Official Fix"
	    cvss_rl = 0.87
	elsif rl == "Temporary Fix"
	    cvss_rl = 0.90
	elsif rl == "Workaround"
	    cvss_rl = 0.95
	else
	    cvss_rl = 1
	end
	if rc == "Unconfirmed"
	    cvss_rc = 0.90
	elsif rc == "Uncorroborated"
	    cvss_rc = 0.95
	else
	    cvss_rc = 1
	end
	if cdp == "Low"
	    cvss_cdp = 0.1
	elsif cdp == "Low-Medium"
	    cvss_cdp = 0.3
	elsif cdp == "Medium-High"
	    cvss_cdp = 0.4
	elsif cdp == "High"
	    cvss_cdp = 0.5
	else
	    cvss_cdp = 0
	end
	if td == "None"
	    cvss_td = 0
	elsif td == "Low"
	    cvss_td = 0.25
	elsif td == "Medium"
	    cvss_td = 0.75
	else
	    cvss_td = 1
	end
	if cr == "Low"
	    cvss_cr = 0.5
	elsif cr == "High"
	    cvss_cr = 1.51
	else
	    cvss_cr = 1
	end
	if ir == "Low"
	    cvss_ir = 0.5
	elsif ir == "High"
	    cvss_ir = 1.51
	else
	    cvss_ir = 1
	end
	if ar == "Low"
	    cvss_ar = 0.5
	elsif ar == "High"
	    cvss_ar = 1.51
	else
	    cvss_ar = 1
	end
	cvss_impact = 10.41 * (1 - (1 - cvss_c) * (1 - cvss_i) * (1 - cvss_a))
	cvss_exploitability = 20 * cvss_ac * cvss_au * cvss_av
	if cvss_impact == 0
	    cvss_impact_f = 0
	else
	    cvss_impact_f = 1.176
	end
	cvss_base = (0.6*cvss_impact + 0.4*cvss_exploitability-1.5)*cvss_impact_f
	cvss_temporal = cvss_base * cvss_e * cvss_rl * cvss_rc
	cvss_modified_impact = [10, 10.41 * (1 - (1 - cvss_c * cvss_cr) * (1 - cvss_i * cvss_ir) * (1 - cvss_a * cvss_ar))].min
	if cvss_modified_impact == 0
	    cvss_modified_impact_f = 0
	else
	    cvss_modified_impact_f = 1.176
	end
	cvss_modified_base = (0.6*cvss_modified_impact + 0.4*cvss_exploitability-1.5)*cvss_modified_impact_f
	cvss_adjusted_temporal = cvss_modified_base * cvss_e * cvss_rl * cvss_rc
	cvss_environmental = (cvss_adjusted_temporal + (10 - cvss_adjusted_temporal) * cvss_cdp) * cvss_td
	if cvss_environmental
	    cvss_total = cvss_environmental
	elsif cvss_temporal
	    cvss_total = cvss_temporal
	else
	    cvss_total = cvss_base
	end
  data["risk_cvss_v2"]=data["risk"]
	data["cvss_base2"] = sprintf("%0.1f" % cvss_base)
	data["cvss_impact2"] = sprintf("%0.1f" % cvss_impact)
	data["cvss_exploitability2"] = sprintf("%0.1f" % cvss_exploitability)
	data["cvss_temporal2"] = sprintf("%0.1f" % cvss_temporal)
	data["cvss_environmental2"] = sprintf("%0.1f" % cvss_environmental)
	data["cvss_modified_impact2"] = sprintf("%0.1f" % cvss_modified_impact)
	data["cvss_total2"] = sprintf("%0.1f" % cvss_total)
	return data
end
def cvss ( data ) av = data [ "av2" ] ac = data [ "ac2" ] au = data [ "au2" ] c = data [ "c2" ] i = data [ "i2" ] a = data [ "a2" ] e = data [ "e2" ] rl = data [ "rl2" ] rc = data [ "rc2" ] cdp = data [ "cdp" ] td = data [ "td" ] cr = data [ "cr2" ] ir = data [ "ir2" ] ar = data [ "ar2" ] if ac == "High" cvss_ac = 0.35 elsif ac == "Medium" cvss_ac = 0.61 else cvss_ac = 0.71 end if au == "None" cvss_au = 0.704 elsif au == "Single" cvss_au = 0.56 else cvss_au = 0.45 end if av == "Local" cvss_av = 0.395 elsif av == "Local Network" cvss_av = 0.646 else cvss_av = 1 end if c == "None" cvss_c = 0 elsif c == "Partial" cvss_c = 0.275 else cvss_c = 0.660 end if i == "None" cvss_i = 00 elsif i == "Partial" cvss_i = 0.275 else cvss_i = 0.660 end if a == "None" cvss_a = 0 elsif a == "Partial" cvss_a = 0.275 else cvss_a = 0.660 end if e == "Unproven Exploit Exists" cvss_e = 0.85 elsif e == "Proof-of-Concept Code" cvss_e = 0.90 elsif e == "Functional Exploit Exists" cvss_e = 0.95 else cvss_e = 1 end if rl == "Official Fix" cvss_rl = 0.87 elsif rl == "Temporary Fix" cvss_rl = 0.90 elsif rl == "Workaround" cvss_rl = 0.95 else cvss_rl = 1 end if rc == "Unconfirmed" cvss_rc = 0.90 elsif rc == "Uncorroborated" cvss_rc = 0.95 else cvss_rc = 1 end if cdp == "Low" cvss_cdp = 0.1 elsif cdp == "Low-Medium" cvss_cdp = 0.3 elsif cdp == "Medium-High" cvss_cdp = 0.4 elsif cdp == "High" cvss_cdp = 0.5 else cvss_cdp = 0 end if td == "None" cvss_td = 0 elsif td == "Low" cvss_td = 0.25 elsif td == "Medium" cvss_td = 0.75 else cvss_td = 1 end if cr == "Low" cvss_cr = 0.5 elsif cr == "High" cvss_cr = 1.51 else cvss_cr = 1 end if ir == "Low" cvss_ir = 0.5 elsif ir == "High" cvss_ir = 1.51 else cvss_ir = 1 end if ar == "Low" cvss_ar = 0.5 elsif ar == "High" cvss_ar = 1.51 else cvss_ar = 1 end cvss_impact = 10.41 * ( 1 - ( 1 - cvss_c ) * ( 1 - cvss_i ) * ( 1 - cvss_a ) ) cvss_exploitability = 20 * cvss_ac * cvss_au * cvss_av if cvss_impact == 0 cvss_impact_f = 0 else cvss_impact_f = 1.176 end cvss_base = ( 0.6 * cvss_impact + 0.4 * cvss_exploitability - 1.5 ) * cvss_impact_f cvss_temporal = cvss_base * cvss_e * cvss_rl * cvss_rc cvss_modified_impact = [ 10 , 10.41 * ( 1 - ( 1 - cvss_c * cvss_cr ) * ( 1 - cvss_i * cvss_ir ) * ( 1 - cvss_a * cvss_ar ) ) ] . min if cvss_modified_impact == 0 cvss_modified_impact_f = 0 else cvss_modified_impact_f = 1.176 end cvss_modified_base = ( 0.6 * cvss_modified_impact + 0.4 * cvss_exploitability - 1.5 ) * cvss_modified_impact_f cvss_adjusted_temporal = cvss_modified_base * cvss_e * cvss_rl * cvss_rc cvss_environmental = ( cvss_adjusted_temporal + ( 10 - cvss_adjusted_temporal ) * cvss_cdp ) * cvss_td if cvss_environmental cvss_total = cvss_environmental elsif cvss_temporal cvss_total = cvss_temporal else cvss_total = cvss_base end data [ "risk_cvss_v2" ] = data [ "risk" ] data [ "cvss_base2" ] = sprintf ( "%0.1f" % cvss_base ) data [ "cvss_impact2" ] = sprintf ( "%0.1f" % cvss_impact ) data [ "cvss_exploitability2" ] = sprintf ( "%0.1f" % cvss_exploitability ) data [ "cvss_temporal2" ] = sprintf ( "%0.1f" % cvss_temporal ) data [ "cvss_environmental2" ] = sprintf ( "%0.1f" % cvss_environmental ) data [ "cvss_modified_impact2" ] = sprintf ( "%0.1f" % cvss_modified_impact ) data [ "cvss_total2" ] = sprintf ( "%0.1f" % cvss_total ) return data end
CVSS helper, there is a lot of hardcoded stuff
CVSS helper there is a lot of hardcoded stuff
# temporal score calculations #environemental #if cvss_total == 0 #data["risk_cvss_v2"]=0 ##data["risk"]=0 #elsif (cvss_total >= 0.1 and cvss_total <= 3.9) #data["risk_cvss_v2"]=1 #data["risk"]=1 #elsif (cvss_total >= 4.0 and cvss_total <= 6.9) #data["risk_cvss_v2"]=2 #data["risk"]=2 #elsif (cvss_total >= 7.0 and cvss_total <= 8.9) #data["risk_cvss_v2"]=3 #data["risk"]=3 #else #data["risk_cvss_v2"]=4 #data["risk"]=4 #end
data
<not_specific>