Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 28 additions & 6 deletions lib/cvss_suite/cvss31/cvss31_base.rb
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,15 @@ def score
exploitability = calc_exploitability
impact_sub_score = calc_impact

return 0 if impact_sub_score <= 0
return 0.0 if impact_sub_score <= 0

if @scope.selected_value[:name] == 'Changed'
[10, 1.08 * (impact_sub_score + exploitability)].min
else
[10, impact_sub_score + exploitability].min
end
raw_score = if @scope.selected_value[:name] == 'Changed'
[10, 1.08 * (impact_sub_score + exploitability)].min
else
[10, impact_sub_score + exploitability].min
end

round_up(raw_score)
end

def impact_subscore
Expand Down Expand Up @@ -99,5 +101,25 @@ def calc_impact
6.42 * isc_base
end
end

##
# Implements the CVSS 3.1 roundup function as specified in Appendix A
# of the CVSS 3.1 specification. This function rounds up to 1 decimal place
# using integer arithmetic to avoid floating point errors.
#
# @param input [Float] The value to round up
# @return [Float] The rounded value
def round_up(input)
# Multiply by 100,000 and round to nearest integer to avoid floating point issues
int_input = (input * 100_000).round

# If the last 4 digits are 0, no rounding up is needed
if int_input % 10_000 == 0
int_input / 100_000.0
else
# Otherwise, round up to the next 0.1
((int_input / 10_000).floor + 1) / 10.0
end
end
end
end