Temporal Score is given even if no temporal metrics are defined about cvss-suite HOT 5 CLOSED

Hey Daniel, I might be wrong but ND are valid values and they also have a score.

https://www.first.org/cvss/v2/guide#3-2-2-Temporal-Equation

TemporalScore = round_to_1_decimal(BaseScore * Exploitability * RemediationLevel * ReportConfidence)

Exploitability = case Exploitability of
unproven: 0.85
proof-of-concept: 0.9
functional: 0.95
high: 1.00
not defined: 1.00

RemediationLevel = case RemediationLevel of
official-fix: 0.87
temporary-fix: 0.90
workaround: 0.95
unavailable: 1.00
not defined: 1.00

ReportConfidence = case ReportConfidence of
unconfirmed: 0.90
uncorroborated: 0.95
confirmed: 1.00
not defined: 1.00

So calculating a score with only ND should give you the base score. Did I misunderstood something?

from cvss-suite.

@dfritsch86 What do you think?

from cvss-suite.

Hi Oliver,

interesting, I was not aware that ND values had a proper scoring value, so you are right that it is not as clear-cut as i initially thought. Reading the temporal metrics introduction, i found the following passage:

Since temporal metrics are optional they each include a metric value that has no effect on the score. This value is used when the user feels the particular metric does not apply and wishes to "skip over" it.

Unfortunately i find the wording a bit ambiguous, but my understanding would be the following: ND allows you to define some of the temporal metrics, while skipping some others without influencing the temporal score (hence the factor 1.00). I am not sure that when all three are skipped (i.e. ND), a temporal score should be returned. This theory is somewhat reinforced by the official V2 calculator: leaving all temporal metrics to ND will result in no temporal score (see screenshot below).

Unfortunately however, i did not find any clarifying hard evidence for this, so my proposal is indeed up for discussion. From a pure user-perspective, i find the absence of a temporal score in such cases more logical.

from cvss-suite.

I think even FIRST isn't sure about this, their own calculator is doing it the other way round (at least for V3). If I was a V3 user I would expect the gem to work like the calculator, wouldn't I?

from cvss-suite.

Will close this issue, if necessary feel free to open it again.

from cvss-suite.