Skip to content

Commit

Permalink
feat(nvd): add cvssMetricV40 (#297)
Browse files Browse the repository at this point in the history
  • Loading branch information
@MaineK00n
MaineK00n authored Jul 1, 2024
1 parent 31d340f commit b870e64
Show file tree
Hide file tree
Showing 4 changed files with 344 additions and 45 deletions.
2 changes: 1 addition & 1 deletion nvd/nvd_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ func TestUpdate(t *testing.T) {
wantFiles: []string{
filepath.Join("api", "2020", "CVE-2020-8167.json"),
filepath.Join("api", "2021", "CVE-2021-22903.json"),
filepath.Join("api", "2021", "CVE-2021-3881.json"),
filepath.Join("api", "2024", "CVE-2024-5732.json"),
"last_updated.json",
},
},
Expand Down
133 changes: 92 additions & 41 deletions nvd/testdata/fixtures/respPage2.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,22 +8,67 @@
"vulnerabilities": [
{
"cve": {
"id": "CVE-2021-3881",
"sourceIdentifier": "[email protected]",
"published": "2021-10-15T14:15:07.907",
"lastModified": "2021-10-22T12:29:28.390",
"id": "CVE-2024-5732",
"sourceIdentifier": "[email protected]",
"published": "2024-06-07T10:15:12.293",
"lastModified": "2024-06-11T17:57:13.767",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libmobi is vulnerable to Out-of-bounds Read"
"value": "A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability."
},
{
"lang": "es",
"value": "libmobi es vulnerable a una lectura fuera de límites"
"value": "Se encontró una vulnerabilidad en Clash hasta 0.20.1 en Windows. Ha sido declarada crítica. Esta vulnerabilidad afecta a un código desconocido del componente Proxy Port. La manipulación conduce a una autenticación incorrecta. El ataque se puede iniciar de forma remota. El exploit ha sido divulgado al público y puede utilizarse. Se recomienda cambiar los ajustes de configuración. VDB-267406 es el identificador asignado a esta vulnerabilidad."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnerableSystemConfidentiality": "LOW",
"vulnerableSystemIntegrity": "LOW",
"vulnerableSystemAvailability": "LOW",
"subsequentSystemConfidentiality": "NONE",
"subsequentSystemIntegrity": "NONE",
"subsequentSystemAvailability": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirements": "NOT_DEFINED",
"integrityRequirements": "NOT_DEFINED",
"availabilityRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
"modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
"modifiedVulnerableSystemAvailability": "NOT_DEFINED",
"modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
"modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
"modifiedSubsequentSystemAvailability": "NOT_DEFINED",
"safety": "NOT_DEFINED",
"automatable": "NOT_DEFINED",
"recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"baseScore": 6.9,
"baseSeverity": "MEDIUM"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
Expand All @@ -44,34 +89,32 @@
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"cvssMetricV30": [
},
{
"source": "[email protected]",
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseScore": 7.3,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Primary",
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
Expand All @@ -96,22 +139,12 @@
},
"weaknesses": [
{
"source": "[email protected]",
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
},
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
"value": "CWE-287"
}
]
}
Expand All @@ -125,9 +158,10 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:libmobi_project:libmobi:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.7",
"matchCriteriaId": "D2333D42-14FA-48A8-873C-573E718CBD86"
"criteria": "cpe:2.3:a:clashforwindows:clash:*:*:*:*:*:windows:*:*",
"versionStartIncluding": "0.1.0",
"versionEndIncluding": "0.20.1",
"matchCriteriaId": "329C7DB6-FE20-4BA7-ADFF-383019916ACC"
}
]
}
Expand All @@ -136,19 +170,36 @@
],
"references": [
{
"url": "https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21",
"source": "[email protected]",
"url": "https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md",
"source": "[email protected]",
"tags": [
"Patch",
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://huntr.dev/bounties/540fd115-7de4-4e19-a918-5ee61f5157c1",
"source": "[email protected]",
"url": "https://vuldb.com/?ctiid.267406",
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.267406",
"source": "[email protected]",
"tags": [
"Permissions Required",
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.345469",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
Expand Down
Loading

0 comments on commit b870e64

Please sign in to comment.