Package: cvsslib
CVSSlibA Python 3 library for calculating CVSS v2, CVSS v3 and CVSS v3.1 vectors, with tests. Examples on how to use
the library is shown below, and there is some documentation on the internals within thedocsdirectory. The library
is designed to be completely extendable, so it is possible to implement your own custom scoring systems (or those of your clients)
and have it work with the same API, and with the same bells and whistles.Python 3 onlyAPIIt's pretty simple to use.cvsslibhas acvss2,cvss3andcvss31sub modules that contains all of the enums
and calculation code. There are also some functions to manipulate vectors that take these cvss modules
as arguments. E.G:fromcvsslibimportcvss2,cvss31,calculate_vectorvector_v2="AV:L/AC:M/Au:S/C:N/I:P/A:C/E:U/RL:OF/RC:UR/CDP:N/TD:L/CR:H/IR:H/AR:H"calculate_vector(vector_v2,cvss2)>>(5,3.5,1.2)vector_v3="CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N"calculate_vector(vector_v3,cvss31)>>(5.8,5.8,7.1)You can access every CVSS enum through thecvss2,cvss3orcvss31modules:fromcvsslibimportcvss2# In this case doing from 'cvsslib.cvss2.enums import *' might be less verbose.value=cvss2.ReportConfidence.CONFIRMEDifvalue!=cvss2.ReportConfidence.NOT_DEFINED:do_something()There are some powerful mixin functions if you need a class with CVSS members. These functions
take a cvss version and return a base class you can inherit from. This class hassome utility functions liketo_vector()andfrom_vector()you can use.fromcvsslibimportcvss3,class_mixinBaseClass=class_mixin(cvss3)# Can pass cvss2 module insteadclassSomeObject(BaseClass):defprint_stats(self):foritem,valueinself.enums:print("{0}is{1}".format(item,value)state=SomeObject()print("\n".join(state.debug()))print(state.calculate())state.from_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N")print("Vector: "+state.to_vector())# Access members:ifstate.report_confidence==ReportConfidence.NOT_DEFINED:do_something()It also supports Django models. Requires thedjango-enumfieldspackage.fromcvsslib.contrib.django_modelimportdjango_mixinfromcvsslibimportcvss2fromdjango.dbimportmodelsCVSSBase=django_mixin(cvss2)classCVSSModel(models.Model,metaclass=CVSSBase)pass# CVSSModel now has lots of enum you can usex=CVSSModel()x.save()x.exploitabilityIf you want it to work with django Migrations you need to give an attribute name to thedjango_mixinfunction. This
should match the attribute name it is being assigned to:CVSSBase=django_mixin(cvss2,attr_name="CVSSBase")And there is a command line tool available:>cvssCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N/E:P/RL:U/RC:U/CR:H/IR:L/AR:H/MAV:L/MUI:R/MS:C/MC:N/MI:L/MA:NBaseScore:5.3Temporal:4.6Environment:1.3Custom Scoring SystemsCreating a new scoring system is very simple. First create a Python file with the correct name, e.gsuper_scores.py.
Next create some enums with the correct values for your system:fromcvsslib.base_enumimportBaseEnumclassRisk(BaseEnum):"""Vector: S"""HIGH=1MEDIUM=2LOW=3classDifficulty(BaseEnum):"""Vector: D"""DIFFICULT=1MODERATE=2EASY=3And lastly add acalculatefunction in the module that accepts some vector values and
returns a result of some kind:defcalculate(difficulty:Difficulty,risk:Risk):ifdifficulty==Difficulty.EASYandrisk==Risk.CRITICAL:return"oh nuts you're screwed"return"You're probs ok m8"Once you define this you can pass yoursuper_scoresmodule to any
cvsslib function likecalculate_vectorordjango_mixinand it will
all just work. You can even serialize the data to and from a vector
if you define the correctvector: Xin the enum docstrings.