CVSS v3.0 support in Software Vulnerability Manager
Software Vulnerability Manager (SVM) supports Common Vulnerability Scoring System (CVSS) v3.0 scores in addition to the Secunia advisory criticality rating.
SVM introduced support for CVSS v3.0 in two phases:
- April 25, 2018: SVM was updated to support CVSS v3.0 data.
- May 18, 2018: Secunia Research began recording CVSS scores using CVSS v3.0.
CVSS scores created before May 18, 2018 weren't updated retroactively. As a result, older advisories can contain CVSS v2.0 scores while advisories created after the transition can contain CVSS v3.0 scores.
For more information about advisory ratings, see Criticality/Severity Rating. Criticality (Severity Rating) | Software Vulnerability Manager Documentation
CVSS v3.0 in the SVM user interface
SVM identifies CVSS v3.0 scores by displaying v3 next to the score in green.
This distinction helps you identify whether an advisory displays a CVSS v2.0 or CVSS v3.0 score.
CVSS v3.0 in the API
The API distinguishes CVSS v2.0 and CVSS v3.0 values.
The existing CVSS Score field represents the CVSS v2.0 value. The field name wasn't changed to preserve compatibility with existing scripts.
CVSS v3.0 values are represented by:
cvss3_scoreFor advisories that use CVSS v3.0, the previous CVSS value can be empty. Integrations that consume CVSS data should account for the separate CVSS v3.0 value.
CVSS v3.0 in XML
The XML schema includes a separate value for CVSS v3.0 so that it can be distinguished from CVSS v2.0.
If you have scripts or integrations that parse CVSS information from XML, review them to make sure they account for the CVSS v3.0 value.
Important: The schema change can affect existing scripts or processes that depend on the previous XML structure.
CVSS v3.0 in email notifications
Email notifications can contain fields for both CVSS v2.0 and CVSS v3.0.
Depending on which CVSS version applies to an advisory, one of the values can be empty.
CVSS v3.0 in PDF reports
PDF reports that contain CVSS information identify the applicable scoring version as:
- CVSS for CVSS v2.0
- CVSS3 for CVSS v3.0
For more on CVSS see https://nvd.nist.gov/vuln-metrics/cvss
Was this helpful?
