Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CWSSv1 Calc integration #539

Open
felix-caboff opened this issue Oct 4, 2024 · 5 comments
Open

CWSSv1 Calc integration #539

felix-caboff opened this issue Oct 4, 2024 · 5 comments
Labels
enhancement New feature or request

Comments

@felix-caboff
Copy link

Is your feature request related to a problem? Please describe.
Following on from the recent work on CVSSv4 integration it would be great to introduce another calculator into the mix. I have often looked at CWSS as a way of helping people get their heads round issues that aren't direct vulnerabilities but are instead related to defence in depth. My experience of CVSS is that you either leave it out or you shoe-horn it in and neither really cuts it. CWSS, whilst a little old, potentially offers a more repeatable and objective method for quantifying these circumstance.

Describe the solution you'd like
It would be great if we could add a new tab to the new CVSS calculator for CWSSv1. In a previous PR I raised this and it was suggested that to make this happen the biggest piece of work would be the creation of a CWSS JavaScript calculator. I had a look around and there appears to be only one of these online at the moment and it isn't marked as free to use. I have then spent time writing a new JavaScript calculator which I believe works correctly etc. (Please see attached).

CWSScalc.html.txt
(In "txt" format for upload to GitHub without potential for execution)

@felix-caboff
Copy link
Author

I have just spotted a calculations issue in the JS I submitted so bare with me on that bit, but in the meantime. Any thoughts or comments on adding this / how to progress it further (as, sorry, I will not likely be able to create a full on PR for it).

@chrismaddalena chrismaddalena added the enhancement New feature or request label Oct 11, 2024
@chrismaddalena
Copy link
Collaborator

That sounds great to me. Thanks for submitting the POC JavaScript! As mentioned in the CVSS PR, the biggest thing will be JavaScript. If we can get a calculator working, the rest shouldn't be too difficult.

@felix-caboff
Copy link
Author

CWSScalc.txt

OK, please discard the first file I provided - this one I am fairly sure works as planned. Probably worth someone else testing that I have the calculations correct though.

@felix-caboff
Copy link
Author

Hi all. What can I do to move this little one along?

@giauen
Copy link

giauen commented Dec 6, 2024

Hello everyone! I'm interested in this topic since I'd like to have another risk calculator. I'm looking for the OWASP risk calculator and I saw that there are already a lot of JavaScript implementation of it. What would you like me to do for getting this calculator? Should I just provide you a simple JS PoC of it? Thanks!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants