/ 
CVSS-1.15
⭐ Starred 0 / CVSS::v4

NAME

CVSS::v4 - Parse and calculate CVSS v4.0 scores

SYNOPSIS

use CVSS::v4;
my $cvss = CVSS::v4->from_vector_string('CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N');

say $cvss->AV; # L
say $cvss->attackVector; # LOCAL

DESCRIPTION

The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of four metric groups: Base, Threat, Environmental, and Supplemental. The Base group represents the intrinsic qualities of a vulnerability that are constant over time and across user environments, the Threat group reflects the characteristics of a vulnerability that change over time, and the Environmental group represents the characteristics of a vulnerability that are unique to a user's environment. Base metric values are combined with default values that assume the highest severity for Threat and Environmental metrics to produce a score ranging from 0 to 10. To further refine a resulting severity score, Threat and Environmental metrics can then be amended based on applicable threat intelligence and environmental considerations. Supplemental metrics do not modify the final score, and are used as additional insight into the characteristics of a vulnerability. A CVSS vector string consists of a compressed textual representation of the values used to derive the score.

https://www.first.org/cvss/v4.0/specification-document

METHODS

CVSS::v4 inherits all methods from CVSS::Base and implements the following new ones.

$cvss->macro_vector

Calculate the macro vector.

$cvss->exploitability

Return the Exploitability severity.

$cvss->complexity

Return the Complexity severity.

$cvss->vulnerable_system

Return the Vulnerable System severity.

$cvss->subsequent_system

Return the Subsequent System severity.

$cvss->exploitation

Return the Exploitation severity.

$cvss->security_requirements

Return the Security Requirements severity.

BASE METRICS

$cvss->AV | $cvss->attackVector
$cvss->AC | $cvss->attackComplexity
$cvss->AT | $cvss->attackRequirements
$cvss->PR | $cvss->privilegesRequired
$cvss->UI | $cvss->userInteraction
$cvss->VC | $cvss->vulnConfidentialityImpact
$cvss->VI | $cvss->vulnIntegrityImpact
$cvss->VA | $cvss->vulnAvailabilityImpact
$cvss->SC | $cvss->subConfidentialityImpact
$cvss->SI | $cvss->subIntegrityImpact
$cvss->SA | $cvss->subAvailabilityImpact

THREAT METRICS

$cvss->E | $cvss->exploitMaturity

ENVIRONMENTAL METRICS

$cvss->CR | $cvss->confidentialityRequirement
$cvss->IR | $cvss->integrityRequirement
$cvss->AR | $cvss->availabilityRequirement
$cvss->MAV | $cvss->modifiedAttackVector
$cvss->MAC | $cvss->modifiedAttackComplexity
$cvss->MAT | $cvss->modifiedAttackRequirements
$cvss->MPR | $cvss->modifiedPrivilegesRequired
$cvss->MUI | $cvss->modifiedUserInteraction
$cvss->MVC | $cvss->modifiedVulnConfidentialityImpact
$cvss->MVI | $cvss->modifiedVulnIntegrityImpact
$cvss->MVA | $cvss->modifiedVulnAvailabilityImpact
$cvss->MSC | $cvss->modifiedSubConfidentialityImpact
$cvss->MSI | $cvss->modifiedSubIntegrityImpact
$cvss->MSA | $cvss->modifiedSubAvailabilityImpact

SUPPLEMENTAL METRICS

$cvss->S | $cvss->Safety
$cvss->AU | $cvss->Automatable
$cvss->R | $cvss->Recovery
$cvss->V | $cvss->valueDensity
$cvss->RE | $cvss->vulnerabilityResponseEffort
$cvss->U | $cvss->providerUrgency

SEE ALSO

CVSS, CVSS::v2, CVSS::v3

[FIRST] CVSS Data Representations (https://www.first.org/cvss/data-representations)
[FIRST] CVSS v4.0 Specification (https://www.first.org/cvss/v4.0/specification-document)

SUPPORT

Bugs / Feature Requests

Please report any bugs or feature requests through the issue tracker at https://github.com/giterlizzi/perl-CVSS/issues. You will be notified automatically of any progress on your issue.

Source Code

This is open source software. The code repository is available for public review and contribution under the terms of the license.

https://github.com/giterlizzi/perl-CVSS

git clone https://github.com/giterlizzi/perl-CVSS.git

AUTHOR

  • Giuseppe Di Terlizzi <gdt@cpan.org>

LICENSE AND COPYRIGHT

This software is copyright (c) 2023-2026 by Giuseppe Di Terlizzi.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.