Fallback to Severity value if CVSS is undefined

[saintbarber]

I would like to propose a small change on the Templates page.

Personally, I do not add CVSS scores to my finding templates, and prefer to specify the Severity field (I set it as a requirement), only if my clients request a CVSS score I add it.

That being said, when I create a finding template, without specifying the CVSS score, and specifying only the Severity (e.g. Criticlal) the finding shows up as Info on main Templates page:

Could we create some sort of fallback, if the CVSS score is undefined within the finding template, to use the Severity value and show only the levelName along with the corresponding colour? e.g.:

If neither the CVSS score, or the Severity is defined within the template, then the default Info 0.0 will be shown.

I tried to implement this myself, but I have absolutely no idea how vue works (I envy those who understand) and unfortunately do not have the time to learn.

Do you guys agree with this? Or is it something you do not plan to add?

Thank you again for the this tool btw, amazing work to everyone involved <3

[aronmolnar]

From the business logic point of view this makes sense and we should implement this.

@MWedl will tell us if there are technical constraints (which I do not expect).

[MWedl]

It definitely makes sense to implement this.

We already have a similar fallback in the finding list of projects for the colored sidebar. In the finding list, severity takes precedence over CVSS. For templates, I'm not sure if we should use the same fallback or if it is better to switch the precedence order (i.e. CVSS > severity). If both, severity and CVSS are defined (and severity takes higher precedence), we can either show only the level (not optimal because the CVSS score is omitted) or combine severity and CVSS score (not optimal because severity level and CVSS level could be different, e.g. severity=high, CVSS=2.3). In findings we do not have this problem, because only the level is used, not the numeric score.

There are not technical constraints, but we need to adapt more parts than just the Vue frontend code. The CVSS score is used for sorting the template list in the database (to be able to use DB pagination). In comparison, the finding list is sorted in the frontend (because you (hopefully) do not have reports with hundreds of findings, causing less server load).

[MWedl]

Created issue #173

[aronmolnar]

Implemented in #173

[saintbarber]

Just tested it out now, amazing job guys!