Invalid CVSS3.1 scores in some cases

[Rogdham]

Hello 👋 I noticed that some scores differ from the First calculator.

Example:

• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• First calculator scores: 9.6 (base), 9.6 (temporal), 9.7 (environmental)
• NIST calculator scores: 9.6 (base) (NIST calculator does not show temporal/environmental score when they are all Xs)
• This lib score: 9.7 (base), 9.7 (temporal), 9.7 (environmental)

const CVSS = require("@turingpointde/cvss.js");

const vector = CVSS("CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
console.log("base", vector.getScore());
console.log("temporal", vector.getTemporalScore());
console.log("environmental", vector.getEnvironmentalScore());

[Fubinator]

Good catch! I'm going to look into this.

@Rogdham Do you know of any other vectors that have wrong ratings?

[Fubinator]

I've fixed it in #73. There were a few wrong calculations. For future reference: The impact sub score is different for base and environmental ratings.

[Rogdham]

Woah, that was fast, thank you @Fubinator I will try the patch when I have a minute and report back 🤗

[Rogdham]

Update: I compared the values for few dozen million different CVSS3.1 vectors, and everything is as expected! 🎉