/ 
SSVC-1.00
/ SSVC

NAME

SSVC - Perl extension for SSVC (Stakeholder-Specific Vulnerability Categorization)

SYNOPSIS

use SSVC;

$ssvc = SSVC->new(
  cisa => {
    exploitation             => 'active',
    automatable              => 'yes',
    technical_impact         => 'partial',
    mission_prevalence       => 'minimal',
    public_well_being_impact => 'irreversible',
  }
);

# - or -

$ssvc = SSVC->new(
  methodology              => 'cisa',
  exploitation             => 'active',
  automatable              => 'yes',
  technical_impact         => 'partial',
  mission_prevalence       => 'minimal',
  public_well_being_impact => 'irreversible',
);

# Get the decision
say $ssvc->decision; # act

# Parse SSVC vector string (only SSVC::CISA implements a vector string grammar)
$ssvc = SSVC::CISA->from_vector_string('SSVCv2/E:A/A:Y/T:P/P:M/B:I/M:H/D:C/2025-01-01T00:00:00');

# Convert the SSVC object in "vector string"
say $ssvc; # SSVCv2/E:A/A:Y/T:P/P:M/B:I/M:H/D:C/2025-01-01T00:00:00

# Get the decision point value
say $ssvc->public_well_being_impact; # irreversible

# Convert SSVC in JSON in according of SSVC JSON Schema
$json = encode_json($ssvc);

DESCRIPTION

SSVC stands for A Stakeholder-Specific Vulnerability Categorization. It is a methodology for prioritizing vulnerabilities based on the needs of the stakeholders involved in the vulnerability management process. SSVC is designed to be used by any stakeholder in the vulnerability management process, including finders, vendors, coordinators, deployers, and others.

https://certcc.github.io/SSVC/

METHODOLOGIES

Only SSVC::CISA implements a "vector string" grammar (from_vector_string / to_vector_string in the SSVCv2/... format); the other methodologies do not have an equivalent official compact representation, so parse/stringify support for them is limited to the generic, non-standard output of SSVC::Base::to_vector_string (<METHODOLOGY-KEY>v1/..., e.g. DEPLOYERv1/... or SUPPLIERv1/...).

OBJECT-ORIENTED INTERFACE

$ssvc = SSVC->new(methodology => $name, %decision_points)
$ssvc = SSVC->new($name => \%decision_points)

Creates a new SSVC instance for the given methodology name, using the provided decision points. Both forms are equivalent; the second is only recognized when called with exactly two arguments and the second one is a hashref - any other shape (e.g. SSVC->new($name => %decision_points) without wrapping them in a hashref) falls through to the first form and requires an explicit methodology key.

SSVC->methodologies

Returns the list of registered methodology names.

SSVC->methodology_class($name)

Returns the class implementing the given methodology name. Croaks if unknown.

SSVC->methodology_info($name)

Returns a hashref describing the given methodology (key, name, description, url) with its decision_points (one entry per decision point: vector_name, label, definition, enum (ordered list of allowed values), labels (code => label) and codes (label => code)). Useful for building any tool that needs to introspect a methodology without hardcoding its decision points.

my $info = SSVC->methodology_info('deployer');
say $info->{name};                                     # Deployer
say $info->{decision_points}{exploitation}{label};     # Exploitation
say join ', ', @{$info->{decision_points}{exploitation}{enum}};
SSVC->register_methodology($name, $methodology_class);

Registers a custom methodology class under $name, making it available to new, methodology_class, methodology_info and methodologies.

$methodology_class must already be loaded and extend SSVC::Base. Croaks otherwise.

package My::SSVC::Methodology {
  use parent 'SSVC::Base';
  use constant DECISION_POINTS => +{ ... };
  use constant DECISION_TREE   => +{ ... };
  use constant DECISION_PATH   => [ ... ];
}

SSVC->register_methodology(my_methodology => 'My::SSVC::Methodology');

$ssvc = SSVC->new(my_methodology => $params);
$ssvc->TO_JSON

Helper method for JSON modules (JSON, JSON::PP, JSON::XS, Mojo::JSON, etc).

Convert the SSVC object in JSON format.

encode_json($ssvc);

SEE ALSO

SSVC::CISA, SSVC::CISA::BOD2604, SSVC::CoordinatorPublication, SSVC::CoordinatorTriage, SSVC::Deployer, SSVC::Supplier

[Carnegie Mellon University] SSVC: Stakeholder-Specific Vulnerability Categorization (https://certcc.github.io/SSVC/)
[CISA] Stakeholder-Specific Vulnerability Categorization Guide (https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf)

SUPPORT

Bugs / Feature Requests

Please report any bugs or feature requests through the issue tracker at https://github.com/giterlizzi/perl-SSVC/issues. You will be notified automatically of any progress on your issue.

Source Code

This is open source software. The code repository is available for public review and contribution under the terms of the license.

https://github.com/giterlizzi/perl-SSVC

git clone https://github.com/giterlizzi/perl-SSVC.git

AUTHOR

  • Giuseppe Di Terlizzi <gdt@cpan.org>

LICENSE AND COPYRIGHT

This software is copyright (c) 2025-2026 by Giuseppe Di Terlizzi.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.