CVSSv4: `environmentalScore`/`environmentalSeverity` and `threatScore`/`threatSeverity` missing

[tschmidtb51]

It looks like the environmentalScore and threatScore as well as the environmentalSeverity and threatSeverity are missing in the JSON output as well as in the severity()' and scores()` functions for CVSSv4.

They are defined in the JSON schema of CVSSv4.

Could you please add them?

[skontar]

That is interesting because as far as I know CVSSv4 has only one composition score and then only one severity (different to how CVSS v2 and v3 behave). I did not look into the schema yet, I think @jsvob did, so I am unsure how to proceed. Are those supposed to be set to the same value? Let me try to ask CVSS SIG people.

[tschmidtb51]

It is defined in the schema:

{
  "license": [
      "Copyright (c) 2023, FIRST.ORG, INC.",
      "All rights reserved.",
      "",
      "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the ",
      "following conditions are met:",
      "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following ",
      "   disclaimer.",
      "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the ",
      "   following disclaimer in the documentation and/or other materials provided with the distribution.",
      "3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote ",
      "   products derived from this software without specific prior written permission.",
      "",
      "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 'AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES, ",
      "INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE ",
      "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, ",
      "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ",
      "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, ",
      "WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE ",
      "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
  ],

  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "JSON Schema for Common Vulnerability Scoring System version 4.0",
  "$id": "https://www.first.org/cvss/cvss-v4.0.json?20240216",
   // ...
      {
          "anyOf": [{
              "properties": {
                "threatScore" : {
                  "$ref": "#/definitions/noneScoreType"
                },
                "threatSeverity" : {
                  "$ref": "#/definitions/noneSeverityType"
                }
              }
            },
            {
              "properties": {
                "threatScore" : {
                  "$ref": "#/definitions/lowScoreType"
                },
                "threatSeverity" : {
                  "$ref": "#/definitions/lowSeverityType"
                }
              }
            },
            {
              "properties": {
                "threatScore" : {
                  "$ref": "#/definitions/mediumScoreType"
                },
                "threatSeverity" : {
                  "$ref": "#/definitions/mediumSeverityType"
                }
              }
            },
            {
              "properties": {
                "threatScore" : {
                  "$ref": "#/definitions/highScoreType"
                },
                "threatSeverity" : {
                  "$ref": "#/definitions/highSeverityType"
                }
              }
            },
            {
              "properties": {
                "threatScore" : {
                  "$ref": "#/definitions/criticalScoreType"
                },
                "threatSeverity" : {
                  "$ref": "#/definitions/criticalSeverityType"
                }
              }
            }
          ]
      },
      {
          "anyOf": [
              {
              "properties": {
                "environmentalScore" : {
                  "$ref": "#/definitions/noneScoreType"
                },
                "environmentalSeverity" : {
                  "$ref": "#/definitions/noneSeverityType"
                }
              }
            },
            {
              "properties": {
                "environmentalScore" : {
                  "$ref": "#/definitions/lowScoreType"
                },
                "environmentalSeverity" : {
                  "$ref": "#/definitions/lowSeverityType"
                }
              }
            },
            {
              "properties": {
                "environmentalScore" : {
                  "$ref": "#/definitions/mediumScoreType"
                },
                "environmentalSeverity" : {
                  "$ref": "#/definitions/mediumSeverityType"
                }
              }
            },
            {
              "properties": {
                "environmentalScore" : {
                  "$ref": "#/definitions/highScoreType"
                },
                "environmentalSeverity" : {
                  "$ref": "#/definitions/highSeverityType"
                }
              }
            },
            {
              "properties": {
                "environmentalScore" : {
                  "$ref": "#/definitions/criticalScoreType"
                },
                "environmentalSeverity" : {
                  "$ref": "#/definitions/criticalSeverityType"
                }
              }
            }
          ]
      }
   // ...
}

[tschmidtb51]

To call the overall score baseScore is IMHO an "interesting" choice.

Anyway, as environmentalScore/environmentalSeverity and threatScore/threatSeverity are in the schema, they need to be computable.

[skontar]

The thing is that in CVSS v4 there is just score and severity. There is no other score and severity to compute as can be seen in https://github.com/RedHatProductSecurity/cvss-v4-calculator/blob/main/cvss40.js . Person who ported the code to the Python library probably tried to be consistent with v2 and v3, so I agree the name is not the best, but also does not matter as we expose mainly .scores() and .severities() which return one value in case of v4.

More interesting is that the schema contains them all. Not sure if that is an oversight or if spec says what should be the value. https://www.first.org/cvss/v4-0/specification-document is unclear in that regard to me. I have asked a person from CVSS SIG to have a look and provide guidance.

[tschmidtb51]

More interesting is that the schema contains them all. Not sure if that is an oversight or if spec says what should be the value. https://www.first.org/cvss/v4-0/specification-document is unclear in that regard to me.

I have a hunch how they should be computed - but indeed clarity from the CVSS SIG would be nice.

[nickleali]

I'll bring this up to the CVSS SIG. We have discussed changing the schema, which I think is the right choice here. The label of baseScore seems inexact, as Stanislav mentions. It really should just be the score.

It's been brought up before but honestly I don't know why we have threatScore or environmentalScore. I think they were really just an oversight from version 3.1 and prior.

[acepace]

I'll bring this up to the CVSS SIG. We have discussed changing the schema, which I think is the right choice here. The label of baseScore seems inexact, as Stanislav mentions. It really should just be the score.

It's been brought up before but honestly I don't know why we have threatScore or environmentalScore. I think they were really just an oversight from version 3.1 and prior.

Any update on this? Is there any way I can help?

[nickleali]

The CVSS SIG has updated the JSON schema definitions to remove the leftover 3.1 expressions of threatScore and environmentalScore. So there is now just baseScore.

https://www.first.org/cvss/data-representations

We're examining a better way to express that, but it will have to come in a future version of the standard.