diff --git a/.github/workflows/deploy_site.yml b/.github/workflows/deploy_site.yml index df0a56b3..1b51a7f3 100644 --- a/.github/workflows/deploy_site.yml +++ b/.github/workflows/deploy_site.yml @@ -32,17 +32,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: '3.12' - name: Install dependencies run: | python -m pip install --upgrade pip - python -m pip install -r requirements.txt + python -m pip install uv + uv sync --project=src --no-dev - name: Setup Pages uses: actions/configure-pages@v5 @@ -50,10 +51,10 @@ jobs: - name: Build Site run: | export PYTHONPATH=src:$PYTHONPATH - mkdocs build --verbose --clean --config-file mkdocs.yml + uv run --project=src mkdocs build --clean --config-file mkdocs.yml - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@v4 with: # Upload entire repository path: 'site' diff --git a/.github/workflows/link_checker.yml b/.github/workflows/link_checker.yml index 9bb6119d..92f87994 100644 --- a/.github/workflows/link_checker.yml +++ b/.github/workflows/link_checker.yml @@ -12,6 +12,7 @@ on: - .github/workflows/linkchecker.yml # run on any PR that changes the pip requirements - requirements.txt + - src/pyproject.toml # let us trigger it manually workflow_dispatch: @@ -20,28 +21,23 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: - python-version: '3.10' + python-version: '3.12' - name: Install dependencies run: | - python -m pip install --upgrade pip - python -m pip install -r requirements.txt - python -m pip install linkchecker - - - name: Install our python stuff - run: | - python -m pip install -e src + python -m pip install --upgrade pip uv + uv sync --dev --project=src - name: Build Site run: | - mkdocs build --verbose --clean --config-file mkdocs.yml + uv run --project=src mkdocs build --verbose --clean --config-file mkdocs.yml - name: Check links run: | - linkchecker site/index.html + uv run --project=src linkchecker site/index.html diff --git a/.github/workflows/lint_md_changes.yml b/.github/workflows/lint_md_changes.yml index 15215556..a3907f04 100644 --- a/.github/workflows/lint_md_changes.yml +++ b/.github/workflows/lint_md_changes.yml @@ -13,10 +13,10 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 with: fetch-depth: 0 - - uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c + - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 id: changed-files with: files: '**/*.md' diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index eda4f001..05f5f658 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -18,25 +18,24 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 with: fetch-tags: true - name: Set up Python 3.12 - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: "3.12" - name: Install dependencies run: | - python -m pip install --upgrade pip - pip install pytest build - if [ -f requirements.txt ]; then pip install -r requirements.txt; fi + python -m pip install --upgrade pip uv + uv sync --project=src --dev --frozen # - uses: psf/black@stable - name: Test with pytest run: | - pytest + uv run --project=src pytest - name: Build run: | - python -m build src + uv build --project=src - name: Upload Artifacts uses: actions/upload-artifact@v4 with: diff --git a/.gitignore b/.gitignore index 48187df3..b066ebee 100644 --- a/.gitignore +++ b/.gitignore @@ -131,3 +131,4 @@ dmypy.json ssvc2-applier-wip.xlsx _version.py node_modules +tmp diff --git a/Makefile b/Makefile index af885c5c..1ae2d193 100644 --- a/Makefile +++ b/Makefile @@ -1,48 +1,89 @@ # Project-specific vars MKDOCS_PORT=8765 DOCKER_DIR=docker +PROJECT_DIR = ./src +DOCKER_COMPOSE=docker-compose --project-directory $(DOCKER_DIR) +UV_RUN=uv run --project $(PROJECT_DIR) # Targets -.PHONY: all test docs docker_test clean help +.PHONY: all test docs api docker_test clean help mdlint_fix up down regenerate_json + all: help +dev: + @echo "Set up dev environment..." + uv sync --dev --project $(PROJECT_DIR) + mdlint_fix: @echo "Running markdownlint..." markdownlint --config .markdownlint.yml --fix . test: @echo "Running tests locally..." - pytest -v src/test + uv run --project $(PROJECT_DIR) pytest -v docker_test: + @echo "Building the latest test image..." + $(DOCKER_COMPOSE) build test @echo "Running tests in Docker..." - pushd $(DOCKER_DIR) && docker-compose run --rm test + $(DOCKER_COMPOSE) run --rm test + +docs_local: + @echo "Building and running docs locally..." + $(UV_RUN) mkdocs serve docs: @echo "Building and running docs in Docker..." - pushd $(DOCKER_DIR) && docker-compose up docs + $(DOCKER_COMPOSE) up docs + +api: + @echo "Building and running API in Docker..." + $(DOCKER_COMPOSE) up api + +api_dev: + $(UV_RUN) uvicorn ssvc.api.main:app --reload up: @echo "Starting Docker services..." - pushd $(DOCKER_DIR) && docker-compose up -d + $(DOCKER_COMPOSE) up -d down: @echo "Stopping Docker services..." - pushd $(DOCKER_DIR) && docker-compose down + $(DOCKER_COMPOSE) down + +regenerate_json: + @echo "Regenerating JSON files..." + rm -rf data/json/decision_points + export PYTHONPATH=$(PWD)/src && ./src/ssvc/doctools.py --datadir=./data --overwrite clean: @echo "Cleaning up Docker resources..." - pushd $(DOCKER_DIR) && docker-compose down --rmi local || true - + $(DOCKER_COMPOSE) down --rmi local || true + rm -rf $(PROJECT_DIR)/.venv $(PROJECT_DIR)/uv.lock help: @echo "Usage: make [target]" @echo "" @echo "Targets:" @echo " all - Display this help message" - @echo " mdlint_fix - Run markdownlint with --fix" - @echo " test - Run the tests in a local shell" - @echo " docs - Build and run the docs Docker service" - @echo " docker_test - Run the tests in a Docker container" - @echo " clean - Remove Docker containers and images" - @echo " help - Display this help message" + + @echo " dev - Set up development environment" + @echo " mdlint_fix - Run markdownlint with fix" + @echo " test - Run tests locally" + @echo " docker_test - Run tests in Docker" + + @echo " docs - Build and run documentation in Docker" + @echo " docs_local - Build and run documentation locally" + + @echo " api - Build and run API in Docker" + @echo " api_dev - Run API locally with auto-reload" + + @echo " up - Start Docker services" + @echo " down - Stop Docker services" + + @echo " regenerate_json - Regenerate JSON files from python modules" + + @echo " clean - Clean up Docker resources" + @echo " help - Display this help message" + + diff --git a/README.md b/README.md index 81b2ef41..6c8354af 100644 --- a/README.md +++ b/README.md @@ -45,20 +45,22 @@ The data folder contains detailed data files that define suggested prioritizatio There are both `.csv` and `.json` files in this directory. -### `/data/csvs/*` +### `/data/csv/*` -The `.csv` files are the primary data files used by the `ssvc.py` module. +The `.csv` files are generated from the python `ssvc` module. -Also included in data are the lookup tables as csv files which `ssvc_v2.py` reads in. -These files define one row per possible path through the trees as described in the documentation. +These files define one row per possible path through the decision tables as described in the documentation. Customizing the "outcome" column in this csv is the primary recommended way that stakeholders might adapt SSVC to their environment. ### `/data/json/*` -These json files are generated examples from the python `ssvc` module. +These json files are generated examples from the python `ssvc` module, +which uses `pydantic` to define the data models. ### `/data/schema/*` and `/data/schema_examples/*` +These json schema files are used to validate the structure of the `.json` files in `/data/json/*`. +They are generated from the python `ssvc` module, which uses `pydantic` to define the data models. These files are used by the `ssvc-calc` module. ## `/docker/*` @@ -85,15 +87,6 @@ These modules are used to generate documentation for various [Decision Points](h Documentation for the `ssvc` module can be found at [https://certcc.github.io/SSVC/reference/code/](https://certcc.github.io/SSVC/reference/code/) -### `src/ssvc_v2.py` - -A basic Python module for interacting with the SSVC trees. `ssvc_v2.py` has -two methods: `applier_tree()` and `developer_tree()` - -The two methods just loop through their respective lookup tables until -they hit a match, then return the outcome. Maybe not the best implementation, -but it worked well enough for what was needed at the time. - ## Local development The simplest way to get started with local development is to use Docker. @@ -140,7 +133,6 @@ Options for running the test suite are provided below. | Make, ~~Docker~~ | `make test` | runs in host OS | | ~~Make~~, ~~Docker~~ | `pytest src/test` | runs in host OS | - ## Environment Variables If you encounter a problem with the `ssvc` module not being found, you may need to set the `PYTHONPATH` environment variable. diff --git a/data/abnf/ssvc_namespace_pattern.abnf b/data/abnf/ssvc_namespace_pattern.abnf new file mode 120000 index 00000000..460bbb0c --- /dev/null +++ b/data/abnf/ssvc_namespace_pattern.abnf @@ -0,0 +1 @@ +../../src/ssvc/utils/ssvc_namespace_pattern.abnf \ No newline at end of file diff --git a/data/csv/cisa/cisa_coordinator_2_0_3.csv b/data/csv/cisa/cisa_coordinator_2_0_3.csv new file mode 100644 index 00000000..e24d6a0e --- /dev/null +++ b/data/csv/cisa/cisa_coordinator_2_0_3.csv @@ -0,0 +1,37 @@ +row,Exploitation v1.1.0,Automatable v2.0.0,Technical Impact v1.0.0,Mission and Well-Being Impact v1.0.0,CISA Levels v1.1.0 (cisa) +0,none,no,partial,low,track +1,none,no,partial,medium,track +2,none,no,partial,high,track +3,none,no,total,low,track +4,none,no,total,medium,track +5,none,no,total,high,track* +6,none,yes,partial,low,track +7,none,yes,partial,medium,track +8,none,yes,partial,high,attend +9,none,yes,total,low,track +10,none,yes,total,medium,track +11,none,yes,total,high,attend +12,public poc,no,partial,low,track +13,public poc,no,partial,medium,track +14,public poc,no,partial,high,track* +15,public poc,no,total,low,track +16,public poc,no,total,medium,track* +17,public poc,no,total,high,attend +18,public poc,yes,partial,low,track +19,public poc,yes,partial,medium,track +20,public poc,yes,partial,high,attend +21,public poc,yes,total,low,track +22,public poc,yes,total,medium,track* +23,public poc,yes,total,high,attend +24,active,no,partial,low,track +25,active,no,partial,medium,track +26,active,no,partial,high,attend +27,active,no,total,low,track +28,active,no,total,medium,attend +29,active,no,total,high,act +30,active,yes,partial,low,attend +31,active,yes,partial,medium,attend +32,active,yes,partial,high,act +33,active,yes,total,low,attend +34,active,yes,total,medium,act +35,active,yes,total,high,act diff --git a/data/csv/cvss/cvss_v4_0_qualitative_severity_ratings_4_0_0.csv b/data/csv/cvss/cvss_v4_0_qualitative_severity_ratings_4_0_0.csv new file mode 100644 index 00000000..bb0b1a7a --- /dev/null +++ b/data/csv/cvss/cvss_v4_0_qualitative_severity_ratings_4_0_0.csv @@ -0,0 +1,325 @@ +row,Equivalence Set 1 v1.0.0 (cvss),Equivalence Set 2 v1.0.0 (cvss),Equivalence Set 3 v1.0.0 (cvss),Equivalence Set 4 v1.0.0 (cvss),Equivalence Set 5 v1.0.0 (cvss),Equivalence Set 6 v1.0.0 (cvss),CVSS Qualitative Severity Rating Scale v1.0.0 (cvss) +0,low,low,low,low,low,low,low +1,medium,low,low,low,low,low,low +2,low,high,low,low,low,low,low +3,low,low,medium,low,low,low,low +4,low,low,low,medium,low,low,low +5,low,low,low,low,medium,low,low +6,low,low,low,low,low,high,low +7,high,low,low,low,low,low,low +8,medium,high,low,low,low,low,low +9,medium,low,medium,low,low,low,low +10,low,high,medium,low,low,low,low +11,low,low,high,low,low,low,low +12,medium,low,low,medium,low,low,low +13,low,high,low,medium,low,low,low +14,low,low,medium,medium,low,low,low +15,low,low,low,high,low,low,low +16,medium,low,low,low,medium,low,low +17,low,high,low,low,medium,low,low +18,low,low,medium,low,medium,low,low +19,low,low,low,medium,medium,low,low +20,low,low,low,low,high,low,low +21,medium,low,low,low,low,high,low +22,low,high,low,low,low,high,low +23,low,low,medium,low,low,high,low +24,low,low,low,medium,low,high,low +25,low,low,low,low,medium,high,low +26,high,high,low,low,low,low,low +27,high,low,medium,low,low,low,low +28,medium,high,medium,low,low,low,low +29,medium,low,high,low,low,low,low +30,low,high,high,low,low,low,low +31,high,low,low,medium,low,low,low +32,medium,high,low,medium,low,low,low +33,medium,low,medium,medium,low,low,low +34,low,high,medium,medium,low,low,low +35,low,low,high,medium,low,low,low +36,medium,low,low,high,low,low,low +37,low,high,low,high,low,low,low +38,low,low,medium,high,low,low,low +39,high,low,low,low,medium,low,low +40,medium,high,low,low,medium,low,low +41,medium,low,medium,low,medium,low,low +42,low,high,medium,low,medium,low,low +43,low,low,high,low,medium,low,low +44,medium,low,low,medium,medium,low,low +45,low,high,low,medium,medium,low,low +46,low,low,medium,medium,medium,low,low +47,low,low,low,high,medium,low,low +48,medium,low,low,low,high,low,low +49,low,high,low,low,high,low,low +50,low,low,medium,low,high,low,low +51,low,low,low,medium,high,low,low +52,high,low,low,low,low,high,low +53,medium,high,low,low,low,high,low +54,medium,low,medium,low,low,high,low +55,low,high,medium,low,low,high,low +56,low,low,high,low,low,high,low +57,medium,low,low,medium,low,high,low +58,low,high,low,medium,low,high,low +59,low,low,medium,medium,low,high,low +60,low,low,low,high,low,high,low +61,medium,low,low,low,medium,high,low +62,low,high,low,low,medium,high,low +63,low,low,medium,low,medium,high,low +64,low,low,low,medium,medium,high,low +65,low,low,low,low,high,high,low +66,high,high,medium,low,low,low,medium +67,high,low,high,low,low,low,medium +68,medium,high,high,low,low,low,medium +69,high,high,low,medium,low,low,medium +70,high,low,medium,medium,low,low,medium +71,medium,high,medium,medium,low,low,medium +72,medium,low,high,medium,low,low,medium +73,low,high,high,medium,low,low,low +74,high,low,low,high,low,low,medium +75,medium,high,low,high,low,low,medium +76,medium,low,medium,high,low,low,medium +77,low,high,medium,high,low,low,medium +78,low,low,high,high,low,low,medium +79,high,high,low,low,medium,low,medium +80,high,low,medium,low,medium,low,medium +81,medium,high,medium,low,medium,low,medium +82,medium,low,high,low,medium,low,medium +83,low,high,high,low,medium,low,medium +84,high,low,low,medium,medium,low,medium +85,medium,high,low,medium,medium,low,medium +86,medium,low,medium,medium,medium,low,medium +87,low,high,medium,medium,medium,low,medium +88,low,low,high,medium,medium,low,medium +89,medium,low,low,high,medium,low,medium +90,low,high,low,high,medium,low,medium +91,low,low,medium,high,medium,low,medium +92,high,low,low,low,high,low,medium +93,medium,high,low,low,high,low,medium +94,medium,low,medium,low,high,low,medium +95,low,high,medium,low,high,low,low +96,low,low,high,low,high,low,medium +97,medium,low,low,medium,high,low,medium +98,low,high,low,medium,high,low,medium +99,low,low,medium,medium,high,low,medium +100,low,low,low,high,high,low,medium +101,high,high,low,low,low,high,low +102,high,low,medium,low,low,high,medium +103,medium,high,medium,low,low,high,medium +104,medium,low,high,low,low,high,medium +105,low,high,high,low,low,high,medium +106,high,low,low,medium,low,high,low +107,medium,high,low,medium,low,high,low +108,medium,low,medium,medium,low,high,medium +109,low,high,medium,medium,low,high,medium +110,low,low,high,medium,low,high,medium +111,medium,low,low,high,low,high,low +112,low,high,low,high,low,high,low +113,low,low,medium,high,low,high,medium +114,high,low,low,low,medium,high,low +115,medium,high,low,low,medium,high,low +116,medium,low,medium,low,medium,high,medium +117,low,high,medium,low,medium,high,low +118,low,low,high,low,medium,high,medium +119,medium,low,low,medium,medium,high,low +120,low,high,low,medium,medium,high,low +121,low,low,medium,medium,medium,high,medium +122,low,low,low,high,medium,high,low +123,medium,low,low,low,high,high,low +124,low,high,low,low,high,high,low +125,low,low,medium,low,high,high,medium +126,low,low,low,medium,high,high,low +127,high,high,high,low,low,low,medium +128,high,high,medium,medium,low,low,medium +129,high,low,high,medium,low,low,high +130,medium,high,high,medium,low,low,medium +131,high,high,low,high,low,low,high +132,high,low,medium,high,low,low,high +133,medium,high,medium,high,low,low,medium +134,medium,low,high,high,low,low,high +135,low,high,high,high,low,low,medium +136,high,high,medium,low,medium,low,high +137,high,low,high,low,medium,low,high +138,medium,high,high,low,medium,low,medium +139,high,high,low,medium,medium,low,medium +140,high,low,medium,medium,medium,low,high +141,medium,high,medium,medium,medium,low,medium +142,medium,low,high,medium,medium,low,medium +143,low,high,high,medium,medium,low,medium +144,high,low,low,high,medium,low,high +145,medium,high,low,high,medium,low,high +146,medium,low,medium,high,medium,low,medium +147,low,high,medium,high,medium,low,medium +148,low,low,high,high,medium,low,medium +149,high,high,low,low,high,low,medium +150,high,low,medium,low,high,low,high +151,medium,high,medium,low,high,low,medium +152,medium,low,high,low,high,low,medium +153,low,high,high,low,high,low,medium +154,high,low,low,medium,high,low,high +155,medium,high,low,medium,high,low,medium +156,medium,low,medium,medium,high,low,medium +157,low,high,medium,medium,high,low,medium +158,low,low,high,medium,high,low,medium +159,medium,low,low,high,high,low,high +160,low,high,low,high,high,low,medium +161,low,low,medium,high,high,low,medium +162,high,high,medium,low,low,high,medium +163,high,low,high,low,low,high,high +164,medium,high,high,low,low,high,medium +165,high,high,low,medium,low,high,medium +166,high,low,medium,medium,low,high,high +167,medium,high,medium,medium,low,high,medium +168,medium,low,high,medium,low,high,medium +169,low,high,high,medium,low,high,medium +170,high,low,low,high,low,high,medium +171,medium,high,low,high,low,high,medium +172,medium,low,medium,high,low,high,medium +173,low,high,medium,high,low,high,medium +174,low,low,high,high,low,high,medium +175,high,high,low,low,medium,high,medium +176,high,low,medium,low,medium,high,high +177,medium,high,medium,low,medium,high,medium +178,medium,low,high,low,medium,high,medium +179,low,high,high,low,medium,high,medium +180,high,low,low,medium,medium,high,medium +181,medium,high,low,medium,medium,high,medium +182,medium,low,medium,medium,medium,high,medium +183,low,high,medium,medium,medium,high,medium +184,low,low,high,medium,medium,high,medium +185,medium,low,low,high,medium,high,medium +186,low,high,low,high,medium,high,medium +187,low,low,medium,high,medium,high,medium +188,high,low,low,low,high,high,medium +189,medium,high,low,low,high,high,medium +190,medium,low,medium,low,high,high,medium +191,low,high,medium,low,high,high,medium +192,low,low,high,low,high,high,medium +193,medium,low,low,medium,high,high,medium +194,low,high,low,medium,high,high,medium +195,low,low,medium,medium,high,high,medium +196,low,low,low,high,high,high,medium +197,high,high,high,medium,low,low,high +198,high,high,medium,high,low,low,high +199,high,low,high,high,low,low,high +200,medium,high,high,high,low,low,high +201,high,high,high,low,medium,low,high +202,high,high,medium,medium,medium,low,high +203,high,low,high,medium,medium,low,high +204,medium,high,high,medium,medium,low,high +205,high,high,low,high,medium,low,high +206,high,low,medium,high,medium,low,high +207,medium,high,medium,high,medium,low,high +208,medium,low,high,high,medium,low,high +209,low,high,high,high,medium,low,high +210,high,high,medium,low,high,low,high +211,high,low,high,low,high,low,high +212,medium,high,high,low,high,low,high +213,high,high,low,medium,high,low,high +214,high,low,medium,medium,high,low,high +215,medium,high,medium,medium,high,low,high +216,medium,low,high,medium,high,low,high +217,low,high,high,medium,high,low,high +218,high,low,low,high,high,low,high +219,medium,high,low,high,high,low,high +220,medium,low,medium,high,high,low,high +221,low,high,medium,high,high,low,high +222,low,low,high,high,high,low,high +223,high,high,high,low,low,high,high +224,high,high,medium,medium,low,high,high +225,high,low,high,medium,low,high,high +226,medium,high,high,medium,low,high,high +227,high,high,low,high,low,high,high +228,high,low,medium,high,low,high,high +229,medium,high,medium,high,low,high,high +230,medium,low,high,high,low,high,high +231,low,high,high,high,low,high,high +232,high,high,medium,low,medium,high,high +233,high,low,high,low,medium,high,high +234,medium,high,high,low,medium,high,high +235,high,high,low,medium,medium,high,medium +236,high,low,medium,medium,medium,high,high +237,medium,high,medium,medium,medium,high,high +238,medium,low,high,medium,medium,high,high +239,low,high,high,medium,medium,high,high +240,high,low,low,high,medium,high,high +241,medium,high,low,high,medium,high,high +242,medium,low,medium,high,medium,high,high +243,low,high,medium,high,medium,high,high +244,low,low,high,high,medium,high,high +245,high,high,low,low,high,high,medium +246,high,low,medium,low,high,high,high +247,medium,high,medium,low,high,high,high +248,medium,low,high,low,high,high,high +249,low,high,high,low,high,high,high +250,high,low,low,medium,high,high,high +251,medium,high,low,medium,high,high,medium +252,medium,low,medium,medium,high,high,high +253,low,high,medium,medium,high,high,high +254,low,low,high,medium,high,high,high +255,medium,low,low,high,high,high,high +256,low,high,low,high,high,high,medium +257,low,low,medium,high,high,high,high +258,high,high,high,high,low,low,critical +259,high,high,high,medium,medium,low,high +260,high,high,medium,high,medium,low,critical +261,high,low,high,high,medium,low,critical +262,medium,high,high,high,medium,low,high +263,high,high,high,low,high,low,critical +264,high,high,medium,medium,high,low,critical +265,high,low,high,medium,high,low,critical +266,medium,high,high,medium,high,low,high +267,high,high,low,high,high,low,critical +268,high,low,medium,high,high,low,critical +269,medium,high,medium,high,high,low,high +270,medium,low,high,high,high,low,critical +271,low,high,high,high,high,low,high +272,high,high,high,medium,low,high,critical +273,high,high,medium,high,low,high,critical +274,high,low,high,high,low,high,critical +275,medium,high,high,high,low,high,critical +276,high,high,high,low,medium,high,high +277,high,high,medium,medium,medium,high,high +278,high,low,high,medium,medium,high,critical +279,medium,high,high,medium,medium,high,high +280,high,high,low,high,medium,high,high +281,high,low,medium,high,medium,high,critical +282,medium,high,medium,high,medium,high,high +283,medium,low,high,high,medium,high,high +284,low,high,high,high,medium,high,high +285,high,high,medium,low,high,high,high +286,high,low,high,low,high,high,critical +287,medium,high,high,low,high,high,high +288,high,high,low,medium,high,high,high +289,high,low,medium,medium,high,high,critical +290,medium,high,medium,medium,high,high,high +291,medium,low,high,medium,high,high,critical +292,low,high,high,medium,high,high,high +293,high,low,low,high,high,high,high +294,medium,high,low,high,high,high,high +295,medium,low,medium,high,high,high,high +296,low,high,medium,high,high,high,high +297,low,low,high,high,high,high,high +298,high,high,high,high,medium,low,critical +299,high,high,high,medium,high,low,critical +300,high,high,medium,high,high,low,critical +301,high,low,high,high,high,low,critical +302,medium,high,high,high,high,low,critical +303,high,high,high,high,low,high,critical +304,high,high,high,medium,medium,high,critical +305,high,high,medium,high,medium,high,critical +306,high,low,high,high,medium,high,critical +307,medium,high,high,high,medium,high,critical +308,high,high,high,low,high,high,critical +309,high,high,medium,medium,high,high,critical +310,high,low,high,medium,high,high,critical +311,medium,high,high,medium,high,high,critical +312,high,high,low,high,high,high,critical +313,high,low,medium,high,high,high,critical +314,medium,high,medium,high,high,high,critical +315,medium,low,high,high,high,high,critical +316,low,high,high,high,high,high,critical +317,high,high,high,high,high,low,critical +318,high,high,high,high,medium,high,critical +319,high,high,high,medium,high,high,critical +320,high,high,medium,high,high,high,critical +321,high,low,high,high,high,high,critical +322,medium,high,high,high,high,high,critical +323,high,high,high,high,high,high,critical diff --git a/data/csv/cvss/cvss_v4_equivalence_set_1_1_0_0.csv b/data/csv/cvss/cvss_v4_equivalence_set_1_1_0_0.csv new file mode 100644 index 00000000..d80c1fe2 --- /dev/null +++ b/data/csv/cvss/cvss_v4_equivalence_set_1_1_0_0.csv @@ -0,0 +1,37 @@ +row,Attack Vector v3.0.1 (cvss),Privileges Required v1.0.1 (cvss),User Interaction v2.0.0 (cvss),Equivalence Set 1 v1.0.0 (cvss) +0,physical,high,active,low +1,local,high,active,low +2,physical,low,active,low +3,physical,high,passive,low +4,adjacent,high,active,low +5,local,low,active,low +6,physical,none,active,low +7,local,high,passive,low +8,physical,low,passive,low +9,physical,high,none,low +10,network,high,active,medium +11,adjacent,low,active,low +12,local,none,active,medium +13,adjacent,high,passive,low +14,local,low,passive,low +15,physical,none,passive,low +16,local,high,none,medium +17,physical,low,none,low +18,network,low,active,medium +19,adjacent,none,active,medium +20,network,high,passive,medium +21,adjacent,low,passive,low +22,local,none,passive,medium +23,adjacent,high,none,medium +24,local,low,none,medium +25,physical,none,none,low +26,network,none,active,medium +27,network,low,passive,medium +28,adjacent,none,passive,medium +29,network,high,none,medium +30,adjacent,low,none,medium +31,local,none,none,medium +32,network,none,passive,medium +33,network,low,none,medium +34,adjacent,none,none,medium +35,network,none,none,high diff --git a/data/csv/cvss/cvss_v4_equivalence_set_2_1_0_0.csv b/data/csv/cvss/cvss_v4_equivalence_set_2_1_0_0.csv new file mode 100644 index 00000000..1ce2c02c --- /dev/null +++ b/data/csv/cvss/cvss_v4_equivalence_set_2_1_0_0.csv @@ -0,0 +1,5 @@ +row,Attack Complexity v3.0.1 (cvss),Attack Requirements v1.0.0 (cvss),Equivalence Set 2 v1.0.0 (cvss) +0,high,present,low +1,low,present,low +2,high,none,low +3,low,none,high diff --git a/data/csv/cvss/cvss_v4_equivalence_set_3_1_0_0.csv b/data/csv/cvss/cvss_v4_equivalence_set_3_1_0_0.csv new file mode 100644 index 00000000..f28168a0 --- /dev/null +++ b/data/csv/cvss/cvss_v4_equivalence_set_3_1_0_0.csv @@ -0,0 +1,28 @@ +row,Confidentiality Impact to the Vulnerable System v3.0.0 (cvss),Integrity Impact to the Vulnerable System v3.0.0 (cvss),Availability Impact to the Vulnerable System v3.0.0 (cvss),Equivalence Set 3 v1.0.0 (cvss) +0,none,none,none,low +1,low,none,none,low +2,none,low,none,low +3,none,none,low,low +4,high,none,none,medium +5,low,low,none,low +6,none,high,none,medium +7,low,none,low,low +8,none,low,low,low +9,none,none,high,medium +10,high,low,none,medium +11,low,high,none,medium +12,high,none,low,medium +13,low,low,low,low +14,none,high,low,medium +15,low,none,high,medium +16,none,low,high,medium +17,high,high,none,high +18,high,low,low,medium +19,low,high,low,medium +20,high,none,high,medium +21,low,low,high,medium +22,none,high,high,medium +23,high,high,low,high +24,high,low,high,medium +25,low,high,high,medium +26,high,high,high,high diff --git a/data/csv/cvss/cvss_v4_equivalence_set_4_1_0_0.csv b/data/csv/cvss/cvss_v4_equivalence_set_4_1_0_0.csv new file mode 100644 index 00000000..42ba3391 --- /dev/null +++ b/data/csv/cvss/cvss_v4_equivalence_set_4_1_0_0.csv @@ -0,0 +1,49 @@ +row,Confidentiality Impact to the Subsequent System v1.0.0 (cvss),Modified Integrity Impact to the Subsequent System (without Not Defined) v1.0.1 (cvss),Modified Availability Impact to the Subsequent System (without Not Defined) v1.0.1 (cvss),Equivalence Set 4 v1.0.0 (cvss) +0,negligible,negligible,negligible,low +1,low,negligible,negligible,low +2,negligible,low,negligible,low +3,negligible,negligible,low,low +4,high,negligible,negligible,medium +5,low,low,negligible,low +6,negligible,high,negligible,medium +7,low,negligible,low,low +8,negligible,low,low,low +9,negligible,negligible,high,medium +10,high,low,negligible,medium +11,low,high,negligible,medium +12,negligible,safety,negligible,high +13,high,negligible,low,medium +14,low,low,low,low +15,negligible,high,low,medium +16,low,negligible,high,medium +17,negligible,low,high,medium +18,negligible,negligible,safety,high +19,high,high,negligible,medium +20,low,safety,negligible,high +21,high,low,low,medium +22,low,high,low,medium +23,negligible,safety,low,high +24,high,negligible,high,medium +25,low,low,high,medium +26,negligible,high,high,medium +27,low,negligible,safety,high +28,negligible,low,safety,high +29,high,safety,negligible,high +30,high,high,low,medium +31,low,safety,low,high +32,high,low,high,medium +33,low,high,high,medium +34,negligible,safety,high,high +35,high,negligible,safety,high +36,low,low,safety,high +37,negligible,high,safety,high +38,high,safety,low,high +39,high,high,high,medium +40,low,safety,high,high +41,high,low,safety,high +42,low,high,safety,high +43,negligible,safety,safety,high +44,high,safety,high,high +45,high,high,safety,high +46,low,safety,safety,high +47,high,safety,safety,high diff --git a/data/csv/cvss/cvss_v4_equivalence_set_5_1_0_0.csv b/data/csv/cvss/cvss_v4_equivalence_set_5_1_0_0.csv new file mode 100644 index 00000000..7daa47d7 --- /dev/null +++ b/data/csv/cvss/cvss_v4_equivalence_set_5_1_0_0.csv @@ -0,0 +1,4 @@ +row,Exploit Maturity (without Not Defined) v2.0.0 (cvss),Equivalence Set 5 v1.0.0 (cvss) +0,unreported,low +1,proof-of-concept,medium +2,attacked,high diff --git a/data/csv/cvss/cvss_v4_equivalence_set_6_1_0_0.csv b/data/csv/cvss/cvss_v4_equivalence_set_6_1_0_0.csv new file mode 100644 index 00000000..22664e9f --- /dev/null +++ b/data/csv/cvss/cvss_v4_equivalence_set_6_1_0_0.csv @@ -0,0 +1,730 @@ +row,Confidentiality Requirement (without Not Defined) v1.1.1 (cvss),Confidentiality Impact to the Vulnerable System v3.0.0 (cvss),Integrity Requirement (without Not Defined) v1.1.1 (cvss),Integrity Impact to the Vulnerable System v3.0.0 (cvss),Availability Requirement (without Not Defined) v1.1.1 (cvss),Availability Impact to the Vulnerable System v3.0.0 (cvss),Equivalence Set 6 v1.0.0 (cvss) +0,low,none,low,none,low,none,low +1,medium,none,low,none,low,none,low +2,low,low,low,none,low,none,low +3,low,none,medium,none,low,none,low +4,low,none,low,low,low,none,low +5,low,none,low,none,medium,none,low +6,low,none,low,none,low,low,low +7,high,none,low,none,low,none,low +8,medium,low,low,none,low,none,low +9,low,high,low,none,low,none,low +10,medium,none,medium,none,low,none,low +11,low,low,medium,none,low,none,low +12,low,none,high,none,low,none,low +13,medium,none,low,low,low,none,low +14,low,low,low,low,low,none,low +15,low,none,medium,low,low,none,low +16,low,none,low,high,low,none,low +17,medium,none,low,none,medium,none,low +18,low,low,low,none,medium,none,low +19,low,none,medium,none,medium,none,low +20,low,none,low,low,medium,none,low +21,low,none,low,none,high,none,low +22,medium,none,low,none,low,low,low +23,low,low,low,none,low,low,low +24,low,none,medium,none,low,low,low +25,low,none,low,low,low,low,low +26,low,none,low,none,medium,low,low +27,low,none,low,none,low,high,low +28,high,low,low,none,low,none,low +29,medium,high,low,none,low,none,low +30,high,none,medium,none,low,none,low +31,medium,low,medium,none,low,none,low +32,low,high,medium,none,low,none,low +33,medium,none,high,none,low,none,low +34,low,low,high,none,low,none,low +35,high,none,low,low,low,none,low +36,medium,low,low,low,low,none,low +37,low,high,low,low,low,none,low +38,medium,none,medium,low,low,none,low +39,low,low,medium,low,low,none,low +40,low,none,high,low,low,none,low +41,medium,none,low,high,low,none,low +42,low,low,low,high,low,none,low +43,low,none,medium,high,low,none,low +44,high,none,low,none,medium,none,low +45,medium,low,low,none,medium,none,low +46,low,high,low,none,medium,none,low +47,medium,none,medium,none,medium,none,low +48,low,low,medium,none,medium,none,low +49,low,none,high,none,medium,none,low +50,medium,none,low,low,medium,none,low +51,low,low,low,low,medium,none,low +52,low,none,medium,low,medium,none,low +53,low,none,low,high,medium,none,low +54,medium,none,low,none,high,none,low +55,low,low,low,none,high,none,low +56,low,none,medium,none,high,none,low +57,low,none,low,low,high,none,low +58,high,none,low,none,low,low,low +59,medium,low,low,none,low,low,low +60,low,high,low,none,low,low,low +61,medium,none,medium,none,low,low,low +62,low,low,medium,none,low,low,low +63,low,none,high,none,low,low,low +64,medium,none,low,low,low,low,low +65,low,low,low,low,low,low,low +66,low,none,medium,low,low,low,low +67,low,none,low,high,low,low,low +68,medium,none,low,none,medium,low,low +69,low,low,low,none,medium,low,low +70,low,none,medium,none,medium,low,low +71,low,none,low,low,medium,low,low +72,low,none,low,none,high,low,low +73,medium,none,low,none,low,high,low +74,low,low,low,none,low,high,low +75,low,none,medium,none,low,high,low +76,low,none,low,low,low,high,low +77,low,none,low,none,medium,high,low +78,high,high,low,none,low,none,high +79,high,low,medium,none,low,none,low +80,medium,high,medium,none,low,none,low +81,high,none,high,none,low,none,low +82,medium,low,high,none,low,none,low +83,low,high,high,none,low,none,low +84,high,low,low,low,low,none,low +85,medium,high,low,low,low,none,low +86,high,none,medium,low,low,none,low +87,medium,low,medium,low,low,none,low +88,low,high,medium,low,low,none,low +89,medium,none,high,low,low,none,low +90,low,low,high,low,low,none,low +91,high,none,low,high,low,none,low +92,medium,low,low,high,low,none,low +93,low,high,low,high,low,none,low +94,medium,none,medium,high,low,none,low +95,low,low,medium,high,low,none,low +96,low,none,high,high,low,none,high +97,high,low,low,none,medium,none,low +98,medium,high,low,none,medium,none,low +99,high,none,medium,none,medium,none,low +100,medium,low,medium,none,medium,none,low +101,low,high,medium,none,medium,none,low +102,medium,none,high,none,medium,none,low +103,low,low,high,none,medium,none,low +104,high,none,low,low,medium,none,low +105,medium,low,low,low,medium,none,low +106,low,high,low,low,medium,none,low +107,medium,none,medium,low,medium,none,low +108,low,low,medium,low,medium,none,low +109,low,none,high,low,medium,none,low +110,medium,none,low,high,medium,none,low +111,low,low,low,high,medium,none,low +112,low,none,medium,high,medium,none,low +113,high,none,low,none,high,none,low +114,medium,low,low,none,high,none,low +115,low,high,low,none,high,none,low +116,medium,none,medium,none,high,none,low +117,low,low,medium,none,high,none,low +118,low,none,high,none,high,none,low +119,medium,none,low,low,high,none,low +120,low,low,low,low,high,none,low +121,low,none,medium,low,high,none,low +122,low,none,low,high,high,none,low +123,high,low,low,none,low,low,low +124,medium,high,low,none,low,low,low +125,high,none,medium,none,low,low,low +126,medium,low,medium,none,low,low,low +127,low,high,medium,none,low,low,low +128,medium,none,high,none,low,low,low +129,low,low,high,none,low,low,low +130,high,none,low,low,low,low,low +131,medium,low,low,low,low,low,low +132,low,high,low,low,low,low,low +133,medium,none,medium,low,low,low,low +134,low,low,medium,low,low,low,low +135,low,none,high,low,low,low,low +136,medium,none,low,high,low,low,low +137,low,low,low,high,low,low,low +138,low,none,medium,high,low,low,low +139,high,none,low,none,medium,low,low +140,medium,low,low,none,medium,low,low +141,low,high,low,none,medium,low,low +142,medium,none,medium,none,medium,low,low +143,low,low,medium,none,medium,low,low +144,low,none,high,none,medium,low,low +145,medium,none,low,low,medium,low,low +146,low,low,low,low,medium,low,low +147,low,none,medium,low,medium,low,low +148,low,none,low,high,medium,low,low +149,medium,none,low,none,high,low,low +150,low,low,low,none,high,low,low +151,low,none,medium,none,high,low,low +152,low,none,low,low,high,low,low +153,high,none,low,none,low,high,low +154,medium,low,low,none,low,high,low +155,low,high,low,none,low,high,low +156,medium,none,medium,none,low,high,low +157,low,low,medium,none,low,high,low +158,low,none,high,none,low,high,low +159,medium,none,low,low,low,high,low +160,low,low,low,low,low,high,low +161,low,none,medium,low,low,high,low +162,low,none,low,high,low,high,low +163,medium,none,low,none,medium,high,low +164,low,low,low,none,medium,high,low +165,low,none,medium,none,medium,high,low +166,low,none,low,low,medium,high,low +167,low,none,low,none,high,high,high +168,high,high,medium,none,low,none,high +169,high,low,high,none,low,none,low +170,medium,high,high,none,low,none,low +171,high,high,low,low,low,none,high +172,high,low,medium,low,low,none,low +173,medium,high,medium,low,low,none,low +174,high,none,high,low,low,none,low +175,medium,low,high,low,low,none,low +176,low,high,high,low,low,none,low +177,high,low,low,high,low,none,low +178,medium,high,low,high,low,none,low +179,high,none,medium,high,low,none,low +180,medium,low,medium,high,low,none,low +181,low,high,medium,high,low,none,low +182,medium,none,high,high,low,none,high +183,low,low,high,high,low,none,high +184,high,high,low,none,medium,none,high +185,high,low,medium,none,medium,none,low +186,medium,high,medium,none,medium,none,low +187,high,none,high,none,medium,none,low +188,medium,low,high,none,medium,none,low +189,low,high,high,none,medium,none,low +190,high,low,low,low,medium,none,low +191,medium,high,low,low,medium,none,low +192,high,none,medium,low,medium,none,low +193,medium,low,medium,low,medium,none,low +194,low,high,medium,low,medium,none,low +195,medium,none,high,low,medium,none,low +196,low,low,high,low,medium,none,low +197,high,none,low,high,medium,none,low +198,medium,low,low,high,medium,none,low +199,low,high,low,high,medium,none,low +200,medium,none,medium,high,medium,none,low +201,low,low,medium,high,medium,none,low +202,low,none,high,high,medium,none,high +203,high,low,low,none,high,none,low +204,medium,high,low,none,high,none,low +205,high,none,medium,none,high,none,low +206,medium,low,medium,none,high,none,low +207,low,high,medium,none,high,none,low +208,medium,none,high,none,high,none,low +209,low,low,high,none,high,none,low +210,high,none,low,low,high,none,low +211,medium,low,low,low,high,none,low +212,low,high,low,low,high,none,low +213,medium,none,medium,low,high,none,low +214,low,low,medium,low,high,none,low +215,low,none,high,low,high,none,low +216,medium,none,low,high,high,none,low +217,low,low,low,high,high,none,low +218,low,none,medium,high,high,none,low +219,high,high,low,none,low,low,high +220,high,low,medium,none,low,low,low +221,medium,high,medium,none,low,low,low +222,high,none,high,none,low,low,low +223,medium,low,high,none,low,low,low +224,low,high,high,none,low,low,low +225,high,low,low,low,low,low,low +226,medium,high,low,low,low,low,low +227,high,none,medium,low,low,low,low +228,medium,low,medium,low,low,low,low +229,low,high,medium,low,low,low,low +230,medium,none,high,low,low,low,low +231,low,low,high,low,low,low,low +232,high,none,low,high,low,low,low +233,medium,low,low,high,low,low,low +234,low,high,low,high,low,low,low +235,medium,none,medium,high,low,low,low +236,low,low,medium,high,low,low,low +237,low,none,high,high,low,low,high +238,high,low,low,none,medium,low,low +239,medium,high,low,none,medium,low,low +240,high,none,medium,none,medium,low,low +241,medium,low,medium,none,medium,low,low +242,low,high,medium,none,medium,low,low +243,medium,none,high,none,medium,low,low +244,low,low,high,none,medium,low,low +245,high,none,low,low,medium,low,low +246,medium,low,low,low,medium,low,low +247,low,high,low,low,medium,low,low +248,medium,none,medium,low,medium,low,low +249,low,low,medium,low,medium,low,low +250,low,none,high,low,medium,low,low +251,medium,none,low,high,medium,low,low +252,low,low,low,high,medium,low,low +253,low,none,medium,high,medium,low,low +254,high,none,low,none,high,low,low +255,medium,low,low,none,high,low,low +256,low,high,low,none,high,low,low +257,medium,none,medium,none,high,low,low +258,low,low,medium,none,high,low,low +259,low,none,high,none,high,low,low +260,medium,none,low,low,high,low,low +261,low,low,low,low,high,low,low +262,low,none,medium,low,high,low,low +263,low,none,low,high,high,low,low +264,high,low,low,none,low,high,low +265,medium,high,low,none,low,high,low +266,high,none,medium,none,low,high,low +267,medium,low,medium,none,low,high,low +268,low,high,medium,none,low,high,low +269,medium,none,high,none,low,high,low +270,low,low,high,none,low,high,low +271,high,none,low,low,low,high,low +272,medium,low,low,low,low,high,low +273,low,high,low,low,low,high,low +274,medium,none,medium,low,low,high,low +275,low,low,medium,low,low,high,low +276,low,none,high,low,low,high,low +277,medium,none,low,high,low,high,low +278,low,low,low,high,low,high,low +279,low,none,medium,high,low,high,low +280,high,none,low,none,medium,high,low +281,medium,low,low,none,medium,high,low +282,low,high,low,none,medium,high,low +283,medium,none,medium,none,medium,high,low +284,low,low,medium,none,medium,high,low +285,low,none,high,none,medium,high,low +286,medium,none,low,low,medium,high,low +287,low,low,low,low,medium,high,low +288,low,none,medium,low,medium,high,low +289,low,none,low,high,medium,high,low +290,medium,none,low,none,high,high,high +291,low,low,low,none,high,high,high +292,low,none,medium,none,high,high,high +293,low,none,low,low,high,high,high +294,high,high,high,none,low,none,high +295,high,high,medium,low,low,none,high +296,high,low,high,low,low,none,low +297,medium,high,high,low,low,none,low +298,high,high,low,high,low,none,high +299,high,low,medium,high,low,none,low +300,medium,high,medium,high,low,none,low +301,high,none,high,high,low,none,high +302,medium,low,high,high,low,none,high +303,low,high,high,high,low,none,high +304,high,high,medium,none,medium,none,high +305,high,low,high,none,medium,none,low +306,medium,high,high,none,medium,none,low +307,high,high,low,low,medium,none,high +308,high,low,medium,low,medium,none,low +309,medium,high,medium,low,medium,none,low +310,high,none,high,low,medium,none,low +311,medium,low,high,low,medium,none,low +312,low,high,high,low,medium,none,low +313,high,low,low,high,medium,none,low +314,medium,high,low,high,medium,none,low +315,high,none,medium,high,medium,none,low +316,medium,low,medium,high,medium,none,low +317,low,high,medium,high,medium,none,low +318,medium,none,high,high,medium,none,high +319,low,low,high,high,medium,none,high +320,high,high,low,none,high,none,high +321,high,low,medium,none,high,none,low +322,medium,high,medium,none,high,none,low +323,high,none,high,none,high,none,low +324,medium,low,high,none,high,none,low +325,low,high,high,none,high,none,low +326,high,low,low,low,high,none,low +327,medium,high,low,low,high,none,low +328,high,none,medium,low,high,none,low +329,medium,low,medium,low,high,none,low +330,low,high,medium,low,high,none,low +331,medium,none,high,low,high,none,low +332,low,low,high,low,high,none,low +333,high,none,low,high,high,none,low +334,medium,low,low,high,high,none,low +335,low,high,low,high,high,none,low +336,medium,none,medium,high,high,none,low +337,low,low,medium,high,high,none,low +338,low,none,high,high,high,none,high +339,high,high,medium,none,low,low,high +340,high,low,high,none,low,low,low +341,medium,high,high,none,low,low,low +342,high,high,low,low,low,low,high +343,high,low,medium,low,low,low,low +344,medium,high,medium,low,low,low,low +345,high,none,high,low,low,low,low +346,medium,low,high,low,low,low,low +347,low,high,high,low,low,low,low +348,high,low,low,high,low,low,low +349,medium,high,low,high,low,low,low +350,high,none,medium,high,low,low,low +351,medium,low,medium,high,low,low,low +352,low,high,medium,high,low,low,low +353,medium,none,high,high,low,low,high +354,low,low,high,high,low,low,high +355,high,high,low,none,medium,low,high +356,high,low,medium,none,medium,low,low +357,medium,high,medium,none,medium,low,low +358,high,none,high,none,medium,low,low +359,medium,low,high,none,medium,low,low +360,low,high,high,none,medium,low,low +361,high,low,low,low,medium,low,low +362,medium,high,low,low,medium,low,low +363,high,none,medium,low,medium,low,low +364,medium,low,medium,low,medium,low,low +365,low,high,medium,low,medium,low,low +366,medium,none,high,low,medium,low,low +367,low,low,high,low,medium,low,low +368,high,none,low,high,medium,low,low +369,medium,low,low,high,medium,low,low +370,low,high,low,high,medium,low,low +371,medium,none,medium,high,medium,low,low +372,low,low,medium,high,medium,low,low +373,low,none,high,high,medium,low,high +374,high,low,low,none,high,low,low +375,medium,high,low,none,high,low,low +376,high,none,medium,none,high,low,low +377,medium,low,medium,none,high,low,low +378,low,high,medium,none,high,low,low +379,medium,none,high,none,high,low,low +380,low,low,high,none,high,low,low +381,high,none,low,low,high,low,low +382,medium,low,low,low,high,low,low +383,low,high,low,low,high,low,low +384,medium,none,medium,low,high,low,low +385,low,low,medium,low,high,low,low +386,low,none,high,low,high,low,low +387,medium,none,low,high,high,low,low +388,low,low,low,high,high,low,low +389,low,none,medium,high,high,low,low +390,high,high,low,none,low,high,high +391,high,low,medium,none,low,high,low +392,medium,high,medium,none,low,high,low +393,high,none,high,none,low,high,low +394,medium,low,high,none,low,high,low +395,low,high,high,none,low,high,low +396,high,low,low,low,low,high,low +397,medium,high,low,low,low,high,low +398,high,none,medium,low,low,high,low +399,medium,low,medium,low,low,high,low +400,low,high,medium,low,low,high,low +401,medium,none,high,low,low,high,low +402,low,low,high,low,low,high,low +403,high,none,low,high,low,high,low +404,medium,low,low,high,low,high,low +405,low,high,low,high,low,high,low +406,medium,none,medium,high,low,high,low +407,low,low,medium,high,low,high,low +408,low,none,high,high,low,high,high +409,high,low,low,none,medium,high,low +410,medium,high,low,none,medium,high,low +411,high,none,medium,none,medium,high,low +412,medium,low,medium,none,medium,high,low +413,low,high,medium,none,medium,high,low +414,medium,none,high,none,medium,high,low +415,low,low,high,none,medium,high,low +416,high,none,low,low,medium,high,low +417,medium,low,low,low,medium,high,low +418,low,high,low,low,medium,high,low +419,medium,none,medium,low,medium,high,low +420,low,low,medium,low,medium,high,low +421,low,none,high,low,medium,high,low +422,medium,none,low,high,medium,high,low +423,low,low,low,high,medium,high,low +424,low,none,medium,high,medium,high,low +425,high,none,low,none,high,high,high +426,medium,low,low,none,high,high,high +427,low,high,low,none,high,high,high +428,medium,none,medium,none,high,high,high +429,low,low,medium,none,high,high,high +430,low,none,high,none,high,high,high +431,medium,none,low,low,high,high,high +432,low,low,low,low,high,high,high +433,low,none,medium,low,high,high,high +434,low,none,low,high,high,high,high +435,high,high,high,low,low,none,high +436,high,high,medium,high,low,none,high +437,high,low,high,high,low,none,high +438,medium,high,high,high,low,none,high +439,high,high,high,none,medium,none,high +440,high,high,medium,low,medium,none,high +441,high,low,high,low,medium,none,low +442,medium,high,high,low,medium,none,low +443,high,high,low,high,medium,none,high +444,high,low,medium,high,medium,none,low +445,medium,high,medium,high,medium,none,low +446,high,none,high,high,medium,none,high +447,medium,low,high,high,medium,none,high +448,low,high,high,high,medium,none,high +449,high,high,medium,none,high,none,high +450,high,low,high,none,high,none,low +451,medium,high,high,none,high,none,low +452,high,high,low,low,high,none,high +453,high,low,medium,low,high,none,low +454,medium,high,medium,low,high,none,low +455,high,none,high,low,high,none,low +456,medium,low,high,low,high,none,low +457,low,high,high,low,high,none,low +458,high,low,low,high,high,none,low +459,medium,high,low,high,high,none,low +460,high,none,medium,high,high,none,low +461,medium,low,medium,high,high,none,low +462,low,high,medium,high,high,none,low +463,medium,none,high,high,high,none,high +464,low,low,high,high,high,none,high +465,high,high,high,none,low,low,high +466,high,high,medium,low,low,low,high +467,high,low,high,low,low,low,low +468,medium,high,high,low,low,low,low +469,high,high,low,high,low,low,high +470,high,low,medium,high,low,low,low +471,medium,high,medium,high,low,low,low +472,high,none,high,high,low,low,high +473,medium,low,high,high,low,low,high +474,low,high,high,high,low,low,high +475,high,high,medium,none,medium,low,high +476,high,low,high,none,medium,low,low +477,medium,high,high,none,medium,low,low +478,high,high,low,low,medium,low,high +479,high,low,medium,low,medium,low,low +480,medium,high,medium,low,medium,low,low +481,high,none,high,low,medium,low,low +482,medium,low,high,low,medium,low,low +483,low,high,high,low,medium,low,low +484,high,low,low,high,medium,low,low +485,medium,high,low,high,medium,low,low +486,high,none,medium,high,medium,low,low +487,medium,low,medium,high,medium,low,low +488,low,high,medium,high,medium,low,low +489,medium,none,high,high,medium,low,high +490,low,low,high,high,medium,low,high +491,high,high,low,none,high,low,high +492,high,low,medium,none,high,low,low +493,medium,high,medium,none,high,low,low +494,high,none,high,none,high,low,low +495,medium,low,high,none,high,low,low +496,low,high,high,none,high,low,low +497,high,low,low,low,high,low,low +498,medium,high,low,low,high,low,low +499,high,none,medium,low,high,low,low +500,medium,low,medium,low,high,low,low +501,low,high,medium,low,high,low,low +502,medium,none,high,low,high,low,low +503,low,low,high,low,high,low,low +504,high,none,low,high,high,low,low +505,medium,low,low,high,high,low,low +506,low,high,low,high,high,low,low +507,medium,none,medium,high,high,low,low +508,low,low,medium,high,high,low,low +509,low,none,high,high,high,low,high +510,high,high,medium,none,low,high,high +511,high,low,high,none,low,high,low +512,medium,high,high,none,low,high,low +513,high,high,low,low,low,high,high +514,high,low,medium,low,low,high,low +515,medium,high,medium,low,low,high,low +516,high,none,high,low,low,high,low +517,medium,low,high,low,low,high,low +518,low,high,high,low,low,high,low +519,high,low,low,high,low,high,low +520,medium,high,low,high,low,high,low +521,high,none,medium,high,low,high,low +522,medium,low,medium,high,low,high,low +523,low,high,medium,high,low,high,low +524,medium,none,high,high,low,high,high +525,low,low,high,high,low,high,high +526,high,high,low,none,medium,high,high +527,high,low,medium,none,medium,high,low +528,medium,high,medium,none,medium,high,low +529,high,none,high,none,medium,high,low +530,medium,low,high,none,medium,high,low +531,low,high,high,none,medium,high,low +532,high,low,low,low,medium,high,low +533,medium,high,low,low,medium,high,low +534,high,none,medium,low,medium,high,low +535,medium,low,medium,low,medium,high,low +536,low,high,medium,low,medium,high,low +537,medium,none,high,low,medium,high,low +538,low,low,high,low,medium,high,low +539,high,none,low,high,medium,high,low +540,medium,low,low,high,medium,high,low +541,low,high,low,high,medium,high,low +542,medium,none,medium,high,medium,high,low +543,low,low,medium,high,medium,high,low +544,low,none,high,high,medium,high,high +545,high,low,low,none,high,high,high +546,medium,high,low,none,high,high,high +547,high,none,medium,none,high,high,high +548,medium,low,medium,none,high,high,high +549,low,high,medium,none,high,high,high +550,medium,none,high,none,high,high,high +551,low,low,high,none,high,high,high +552,high,none,low,low,high,high,high +553,medium,low,low,low,high,high,high +554,low,high,low,low,high,high,high +555,medium,none,medium,low,high,high,high +556,low,low,medium,low,high,high,high +557,low,none,high,low,high,high,high +558,medium,none,low,high,high,high,high +559,low,low,low,high,high,high,high +560,low,none,medium,high,high,high,high +561,high,high,high,high,low,none,high +562,high,high,high,low,medium,none,high +563,high,high,medium,high,medium,none,high +564,high,low,high,high,medium,none,high +565,medium,high,high,high,medium,none,high +566,high,high,high,none,high,none,high +567,high,high,medium,low,high,none,high +568,high,low,high,low,high,none,low +569,medium,high,high,low,high,none,low +570,high,high,low,high,high,none,high +571,high,low,medium,high,high,none,low +572,medium,high,medium,high,high,none,low +573,high,none,high,high,high,none,high +574,medium,low,high,high,high,none,high +575,low,high,high,high,high,none,high +576,high,high,high,low,low,low,high +577,high,high,medium,high,low,low,high +578,high,low,high,high,low,low,high +579,medium,high,high,high,low,low,high +580,high,high,high,none,medium,low,high +581,high,high,medium,low,medium,low,high +582,high,low,high,low,medium,low,low +583,medium,high,high,low,medium,low,low +584,high,high,low,high,medium,low,high +585,high,low,medium,high,medium,low,low +586,medium,high,medium,high,medium,low,low +587,high,none,high,high,medium,low,high +588,medium,low,high,high,medium,low,high +589,low,high,high,high,medium,low,high +590,high,high,medium,none,high,low,high +591,high,low,high,none,high,low,low +592,medium,high,high,none,high,low,low +593,high,high,low,low,high,low,high +594,high,low,medium,low,high,low,low +595,medium,high,medium,low,high,low,low +596,high,none,high,low,high,low,low +597,medium,low,high,low,high,low,low +598,low,high,high,low,high,low,low +599,high,low,low,high,high,low,low +600,medium,high,low,high,high,low,low +601,high,none,medium,high,high,low,low +602,medium,low,medium,high,high,low,low +603,low,high,medium,high,high,low,low +604,medium,none,high,high,high,low,high +605,low,low,high,high,high,low,high +606,high,high,high,none,low,high,high +607,high,high,medium,low,low,high,high +608,high,low,high,low,low,high,low +609,medium,high,high,low,low,high,low +610,high,high,low,high,low,high,high +611,high,low,medium,high,low,high,low +612,medium,high,medium,high,low,high,low +613,high,none,high,high,low,high,high +614,medium,low,high,high,low,high,high +615,low,high,high,high,low,high,high +616,high,high,medium,none,medium,high,high +617,high,low,high,none,medium,high,low +618,medium,high,high,none,medium,high,low +619,high,high,low,low,medium,high,high +620,high,low,medium,low,medium,high,low +621,medium,high,medium,low,medium,high,low +622,high,none,high,low,medium,high,low +623,medium,low,high,low,medium,high,low +624,low,high,high,low,medium,high,low +625,high,low,low,high,medium,high,low +626,medium,high,low,high,medium,high,low +627,high,none,medium,high,medium,high,low +628,medium,low,medium,high,medium,high,low +629,low,high,medium,high,medium,high,low +630,medium,none,high,high,medium,high,high +631,low,low,high,high,medium,high,high +632,high,high,low,none,high,high,high +633,high,low,medium,none,high,high,high +634,medium,high,medium,none,high,high,high +635,high,none,high,none,high,high,high +636,medium,low,high,none,high,high,high +637,low,high,high,none,high,high,high +638,high,low,low,low,high,high,high +639,medium,high,low,low,high,high,high +640,high,none,medium,low,high,high,high +641,medium,low,medium,low,high,high,high +642,low,high,medium,low,high,high,high +643,medium,none,high,low,high,high,high +644,low,low,high,low,high,high,high +645,high,none,low,high,high,high,high +646,medium,low,low,high,high,high,high +647,low,high,low,high,high,high,high +648,medium,none,medium,high,high,high,high +649,low,low,medium,high,high,high,high +650,low,none,high,high,high,high,high +651,high,high,high,high,medium,none,high +652,high,high,high,low,high,none,high +653,high,high,medium,high,high,none,high +654,high,low,high,high,high,none,high +655,medium,high,high,high,high,none,high +656,high,high,high,high,low,low,high +657,high,high,high,low,medium,low,high +658,high,high,medium,high,medium,low,high +659,high,low,high,high,medium,low,high +660,medium,high,high,high,medium,low,high +661,high,high,high,none,high,low,high +662,high,high,medium,low,high,low,high +663,high,low,high,low,high,low,low +664,medium,high,high,low,high,low,low +665,high,high,low,high,high,low,high +666,high,low,medium,high,high,low,low +667,medium,high,medium,high,high,low,low +668,high,none,high,high,high,low,high +669,medium,low,high,high,high,low,high +670,low,high,high,high,high,low,high +671,high,high,high,low,low,high,high +672,high,high,medium,high,low,high,high +673,high,low,high,high,low,high,high +674,medium,high,high,high,low,high,high +675,high,high,high,none,medium,high,high +676,high,high,medium,low,medium,high,high +677,high,low,high,low,medium,high,low +678,medium,high,high,low,medium,high,low +679,high,high,low,high,medium,high,high +680,high,low,medium,high,medium,high,low +681,medium,high,medium,high,medium,high,low +682,high,none,high,high,medium,high,high +683,medium,low,high,high,medium,high,high +684,low,high,high,high,medium,high,high +685,high,high,medium,none,high,high,high +686,high,low,high,none,high,high,high +687,medium,high,high,none,high,high,high +688,high,high,low,low,high,high,high +689,high,low,medium,low,high,high,high +690,medium,high,medium,low,high,high,high +691,high,none,high,low,high,high,high +692,medium,low,high,low,high,high,high +693,low,high,high,low,high,high,high +694,high,low,low,high,high,high,high +695,medium,high,low,high,high,high,high +696,high,none,medium,high,high,high,high +697,medium,low,medium,high,high,high,high +698,low,high,medium,high,high,high,high +699,medium,none,high,high,high,high,high +700,low,low,high,high,high,high,high +701,high,high,high,high,high,none,high +702,high,high,high,high,medium,low,high +703,high,high,high,low,high,low,high +704,high,high,medium,high,high,low,high +705,high,low,high,high,high,low,high +706,medium,high,high,high,high,low,high +707,high,high,high,high,low,high,high +708,high,high,high,low,medium,high,high +709,high,high,medium,high,medium,high,high +710,high,low,high,high,medium,high,high +711,medium,high,high,high,medium,high,high +712,high,high,high,none,high,high,high +713,high,high,medium,low,high,high,high +714,high,low,high,low,high,high,high +715,medium,high,high,low,high,high,high +716,high,high,low,high,high,high,high +717,high,low,medium,high,high,high,high +718,medium,high,medium,high,high,high,high +719,high,none,high,high,high,high,high +720,medium,low,high,high,high,high,high +721,low,high,high,high,high,high,high +722,high,high,high,high,high,low,high +723,high,high,high,high,medium,high,high +724,high,high,high,low,high,high,high +725,high,high,medium,high,high,high,high +726,high,low,high,high,high,high,high +727,medium,high,high,high,high,high,high +728,high,high,high,high,high,high,high diff --git a/data/csv/ssvc/coordinator_publish_decision_table_1_0_0.csv b/data/csv/ssvc/coordinator_publish_decision_table_1_0_0.csv new file mode 100644 index 00000000..60b8b32a --- /dev/null +++ b/data/csv/ssvc/coordinator_publish_decision_table_1_0_0.csv @@ -0,0 +1,28 @@ +row,Supplier Involvement v1.0.0,Exploitation v1.1.0,Public Value Added v1.0.0,"Publish, Do Not Publish v1.0.0" +0,fix ready,none,limited,do not publish +1,cooperative,none,limited,do not publish +2,fix ready,public poc,limited,do not publish +3,fix ready,none,ampliative,do not publish +4,uncooperative/unresponsive,none,limited,do not publish +5,cooperative,public poc,limited,do not publish +6,fix ready,active,limited,do not publish +7,cooperative,none,ampliative,do not publish +8,fix ready,public poc,ampliative,do not publish +9,fix ready,none,precedence,publish +10,uncooperative/unresponsive,public poc,limited,do not publish +11,cooperative,active,limited,do not publish +12,uncooperative/unresponsive,none,ampliative,do not publish +13,cooperative,public poc,ampliative,do not publish +14,fix ready,active,ampliative,publish +15,cooperative,none,precedence,publish +16,fix ready,public poc,precedence,publish +17,uncooperative/unresponsive,active,limited,publish +18,uncooperative/unresponsive,public poc,ampliative,publish +19,cooperative,active,ampliative,publish +20,uncooperative/unresponsive,none,precedence,publish +21,cooperative,public poc,precedence,publish +22,fix ready,active,precedence,publish +23,uncooperative/unresponsive,active,ampliative,publish +24,uncooperative/unresponsive,public poc,precedence,publish +25,cooperative,active,precedence,publish +26,uncooperative/unresponsive,active,precedence,publish diff --git a/data/csv/ssvc/coordinator_triage_1_0_0.csv b/data/csv/ssvc/coordinator_triage_1_0_0.csv new file mode 100644 index 00000000..5d5c8ee8 --- /dev/null +++ b/data/csv/ssvc/coordinator_triage_1_0_0.csv @@ -0,0 +1,193 @@ +row,Report Public v1.0.0,Supplier Contacted v1.0.0,Report Credibility v1.0.0,Supplier Cardinality v1.0.0,Supplier Engagement v1.0.0,Utility v1.0.1,Public Safety Impact v2.0.1,"Decline, Track, Coordinate v1.0.1" +0,yes,no,not credible,one,active,laborious,minimal,decline +1,no,no,not credible,one,active,laborious,minimal,decline +2,yes,yes,not credible,one,active,laborious,minimal,decline +3,yes,no,credible,one,active,laborious,minimal,decline +4,yes,no,not credible,multiple,active,laborious,minimal,decline +5,yes,no,not credible,one,unresponsive,laborious,minimal,decline +6,yes,no,not credible,one,active,efficient,minimal,decline +7,yes,no,not credible,one,active,laborious,significant,decline +8,no,yes,not credible,one,active,laborious,minimal,decline +9,no,no,credible,one,active,laborious,minimal,decline +10,yes,yes,credible,one,active,laborious,minimal,decline +11,no,no,not credible,multiple,active,laborious,minimal,decline +12,yes,yes,not credible,multiple,active,laborious,minimal,decline +13,yes,no,credible,multiple,active,laborious,minimal,decline +14,no,no,not credible,one,unresponsive,laborious,minimal,decline +15,yes,yes,not credible,one,unresponsive,laborious,minimal,decline +16,yes,no,credible,one,unresponsive,laborious,minimal,decline +17,yes,no,not credible,multiple,unresponsive,laborious,minimal,decline +18,no,no,not credible,one,active,efficient,minimal,decline +19,yes,yes,not credible,one,active,efficient,minimal,decline +20,yes,no,credible,one,active,efficient,minimal,decline +21,yes,no,not credible,multiple,active,efficient,minimal,decline +22,yes,no,not credible,one,unresponsive,efficient,minimal,decline +23,yes,no,not credible,one,active,super effective,minimal,decline +24,no,no,not credible,one,active,laborious,significant,decline +25,yes,yes,not credible,one,active,laborious,significant,decline +26,yes,no,credible,one,active,laborious,significant,decline +27,yes,no,not credible,multiple,active,laborious,significant,decline +28,yes,no,not credible,one,unresponsive,laborious,significant,decline +29,yes,no,not credible,one,active,efficient,significant,decline +30,no,yes,credible,one,active,laborious,minimal,decline +31,no,yes,not credible,multiple,active,laborious,minimal,decline +32,no,no,credible,multiple,active,laborious,minimal,decline +33,yes,yes,credible,multiple,active,laborious,minimal,decline +34,no,yes,not credible,one,unresponsive,laborious,minimal,decline +35,no,no,credible,one,unresponsive,laborious,minimal,decline +36,yes,yes,credible,one,unresponsive,laborious,minimal,decline +37,no,no,not credible,multiple,unresponsive,laborious,minimal,decline +38,yes,yes,not credible,multiple,unresponsive,laborious,minimal,decline +39,yes,no,credible,multiple,unresponsive,laborious,minimal,decline +40,no,yes,not credible,one,active,efficient,minimal,decline +41,no,no,credible,one,active,efficient,minimal,decline +42,yes,yes,credible,one,active,efficient,minimal,decline +43,no,no,not credible,multiple,active,efficient,minimal,decline +44,yes,yes,not credible,multiple,active,efficient,minimal,decline +45,yes,no,credible,multiple,active,efficient,minimal,decline +46,no,no,not credible,one,unresponsive,efficient,minimal,decline +47,yes,yes,not credible,one,unresponsive,efficient,minimal,decline +48,yes,no,credible,one,unresponsive,efficient,minimal,decline +49,yes,no,not credible,multiple,unresponsive,efficient,minimal,decline +50,no,no,not credible,one,active,super effective,minimal,decline +51,yes,yes,not credible,one,active,super effective,minimal,decline +52,yes,no,credible,one,active,super effective,minimal,decline +53,yes,no,not credible,multiple,active,super effective,minimal,decline +54,yes,no,not credible,one,unresponsive,super effective,minimal,decline +55,no,yes,not credible,one,active,laborious,significant,decline +56,no,no,credible,one,active,laborious,significant,decline +57,yes,yes,credible,one,active,laborious,significant,decline +58,no,no,not credible,multiple,active,laborious,significant,decline +59,yes,yes,not credible,multiple,active,laborious,significant,decline +60,yes,no,credible,multiple,active,laborious,significant,decline +61,no,no,not credible,one,unresponsive,laborious,significant,decline +62,yes,yes,not credible,one,unresponsive,laborious,significant,decline +63,yes,no,credible,one,unresponsive,laborious,significant,decline +64,yes,no,not credible,multiple,unresponsive,laborious,significant,decline +65,no,no,not credible,one,active,efficient,significant,decline +66,yes,yes,not credible,one,active,efficient,significant,decline +67,yes,no,credible,one,active,efficient,significant,decline +68,yes,no,not credible,multiple,active,efficient,significant,decline +69,yes,no,not credible,one,unresponsive,efficient,significant,decline +70,yes,no,not credible,one,active,super effective,significant,decline +71,no,yes,credible,multiple,active,laborious,minimal,decline +72,no,yes,credible,one,unresponsive,laborious,minimal,track +73,no,yes,not credible,multiple,unresponsive,laborious,minimal,decline +74,no,no,credible,multiple,unresponsive,laborious,minimal,decline +75,yes,yes,credible,multiple,unresponsive,laborious,minimal,decline +76,no,yes,credible,one,active,efficient,minimal,decline +77,no,yes,not credible,multiple,active,efficient,minimal,decline +78,no,no,credible,multiple,active,efficient,minimal,decline +79,yes,yes,credible,multiple,active,efficient,minimal,decline +80,no,yes,not credible,one,unresponsive,efficient,minimal,decline +81,no,no,credible,one,unresponsive,efficient,minimal,decline +82,yes,yes,credible,one,unresponsive,efficient,minimal,decline +83,no,no,not credible,multiple,unresponsive,efficient,minimal,decline +84,yes,yes,not credible,multiple,unresponsive,efficient,minimal,decline +85,yes,no,credible,multiple,unresponsive,efficient,minimal,decline +86,no,yes,not credible,one,active,super effective,minimal,decline +87,no,no,credible,one,active,super effective,minimal,decline +88,yes,yes,credible,one,active,super effective,minimal,decline +89,no,no,not credible,multiple,active,super effective,minimal,decline +90,yes,yes,not credible,multiple,active,super effective,minimal,decline +91,yes,no,credible,multiple,active,super effective,minimal,decline +92,no,no,not credible,one,unresponsive,super effective,minimal,decline +93,yes,yes,not credible,one,unresponsive,super effective,minimal,decline +94,yes,no,credible,one,unresponsive,super effective,minimal,decline +95,yes,no,not credible,multiple,unresponsive,super effective,minimal,decline +96,no,yes,credible,one,active,laborious,significant,decline +97,no,yes,not credible,multiple,active,laborious,significant,track +98,no,no,credible,multiple,active,laborious,significant,decline +99,yes,yes,credible,multiple,active,laborious,significant,decline +100,no,yes,not credible,one,unresponsive,laborious,significant,decline +101,no,no,credible,one,unresponsive,laborious,significant,decline +102,yes,yes,credible,one,unresponsive,laborious,significant,decline +103,no,no,not credible,multiple,unresponsive,laborious,significant,decline +104,yes,yes,not credible,multiple,unresponsive,laborious,significant,decline +105,yes,no,credible,multiple,unresponsive,laborious,significant,decline +106,no,yes,not credible,one,active,efficient,significant,track +107,no,no,credible,one,active,efficient,significant,decline +108,yes,yes,credible,one,active,efficient,significant,decline +109,no,no,not credible,multiple,active,efficient,significant,decline +110,yes,yes,not credible,multiple,active,efficient,significant,decline +111,yes,no,credible,multiple,active,efficient,significant,decline +112,no,no,not credible,one,unresponsive,efficient,significant,decline +113,yes,yes,not credible,one,unresponsive,efficient,significant,decline +114,yes,no,credible,one,unresponsive,efficient,significant,decline +115,yes,no,not credible,multiple,unresponsive,efficient,significant,decline +116,no,no,not credible,one,active,super effective,significant,decline +117,yes,yes,not credible,one,active,super effective,significant,decline +118,yes,no,credible,one,active,super effective,significant,decline +119,yes,no,not credible,multiple,active,super effective,significant,coordinate +120,yes,no,not credible,one,unresponsive,super effective,significant,decline +121,no,yes,credible,multiple,unresponsive,laborious,minimal,coordinate +122,no,yes,credible,multiple,active,efficient,minimal,decline +123,no,yes,credible,one,unresponsive,efficient,minimal,coordinate +124,no,yes,not credible,multiple,unresponsive,efficient,minimal,decline +125,no,no,credible,multiple,unresponsive,efficient,minimal,decline +126,yes,yes,credible,multiple,unresponsive,efficient,minimal,decline +127,no,yes,credible,one,active,super effective,minimal,decline +128,no,yes,not credible,multiple,active,super effective,minimal,track +129,no,no,credible,multiple,active,super effective,minimal,decline +130,yes,yes,credible,multiple,active,super effective,minimal,decline +131,no,yes,not credible,one,unresponsive,super effective,minimal,decline +132,no,no,credible,one,unresponsive,super effective,minimal,decline +133,yes,yes,credible,one,unresponsive,super effective,minimal,decline +134,no,no,not credible,multiple,unresponsive,super effective,minimal,decline +135,yes,yes,not credible,multiple,unresponsive,super effective,minimal,decline +136,yes,no,credible,multiple,unresponsive,super effective,minimal,decline +137,no,yes,credible,multiple,active,laborious,significant,track +138,no,yes,credible,one,unresponsive,laborious,significant,coordinate +139,no,yes,not credible,multiple,unresponsive,laborious,significant,track +140,no,no,credible,multiple,unresponsive,laborious,significant,decline +141,yes,yes,credible,multiple,unresponsive,laborious,significant,decline +142,no,yes,credible,one,active,efficient,significant,track +143,no,yes,not credible,multiple,active,efficient,significant,track +144,no,no,credible,multiple,active,efficient,significant,decline +145,yes,yes,credible,multiple,active,efficient,significant,decline +146,no,yes,not credible,one,unresponsive,efficient,significant,track +147,no,no,credible,one,unresponsive,efficient,significant,decline +148,yes,yes,credible,one,unresponsive,efficient,significant,decline +149,no,no,not credible,multiple,unresponsive,efficient,significant,decline +150,yes,yes,not credible,multiple,unresponsive,efficient,significant,decline +151,yes,no,credible,multiple,unresponsive,efficient,significant,decline +152,no,yes,not credible,one,active,super effective,significant,track +153,no,no,credible,one,active,super effective,significant,decline +154,yes,yes,credible,one,active,super effective,significant,decline +155,no,no,not credible,multiple,active,super effective,significant,coordinate +156,yes,yes,not credible,multiple,active,super effective,significant,coordinate +157,yes,no,credible,multiple,active,super effective,significant,coordinate +158,no,no,not credible,one,unresponsive,super effective,significant,decline +159,yes,yes,not credible,one,unresponsive,super effective,significant,decline +160,yes,no,credible,one,unresponsive,super effective,significant,decline +161,yes,no,not credible,multiple,unresponsive,super effective,significant,coordinate +162,no,yes,credible,multiple,unresponsive,efficient,minimal,coordinate +163,no,yes,credible,multiple,active,super effective,minimal,coordinate +164,no,yes,credible,one,unresponsive,super effective,minimal,coordinate +165,no,yes,not credible,multiple,unresponsive,super effective,minimal,track +166,no,no,credible,multiple,unresponsive,super effective,minimal,decline +167,yes,yes,credible,multiple,unresponsive,super effective,minimal,decline +168,no,yes,credible,multiple,unresponsive,laborious,significant,coordinate +169,no,yes,credible,multiple,active,efficient,significant,track +170,no,yes,credible,one,unresponsive,efficient,significant,coordinate +171,no,yes,not credible,multiple,unresponsive,efficient,significant,track +172,no,no,credible,multiple,unresponsive,efficient,significant,decline +173,yes,yes,credible,multiple,unresponsive,efficient,significant,decline +174,no,yes,credible,one,active,super effective,significant,track +175,no,yes,not credible,multiple,active,super effective,significant,coordinate +176,no,no,credible,multiple,active,super effective,significant,coordinate +177,yes,yes,credible,multiple,active,super effective,significant,coordinate +178,no,yes,not credible,one,unresponsive,super effective,significant,track +179,no,no,credible,one,unresponsive,super effective,significant,decline +180,yes,yes,credible,one,unresponsive,super effective,significant,decline +181,no,no,not credible,multiple,unresponsive,super effective,significant,coordinate +182,yes,yes,not credible,multiple,unresponsive,super effective,significant,coordinate +183,yes,no,credible,multiple,unresponsive,super effective,significant,coordinate +184,no,yes,credible,multiple,unresponsive,super effective,minimal,coordinate +185,no,yes,credible,multiple,unresponsive,efficient,significant,coordinate +186,no,yes,credible,multiple,active,super effective,significant,coordinate +187,no,yes,credible,one,unresponsive,super effective,significant,coordinate +188,no,yes,not credible,multiple,unresponsive,super effective,significant,coordinate +189,no,no,credible,multiple,unresponsive,super effective,significant,coordinate +190,yes,yes,credible,multiple,unresponsive,super effective,significant,coordinate +191,no,yes,credible,multiple,unresponsive,super effective,significant,coordinate diff --git a/data/csv/ssvc/deployer_patch_application_priority_1_0_0.csv b/data/csv/ssvc/deployer_patch_application_priority_1_0_0.csv new file mode 100644 index 00000000..345b4bf0 --- /dev/null +++ b/data/csv/ssvc/deployer_patch_application_priority_1_0_0.csv @@ -0,0 +1,73 @@ +row,Exploitation v1.1.0,System Exposure v1.0.1,Automatable v2.0.0,Human Impact v2.0.2,"Defer, Scheduled, Out-of-Cycle, Immediate v1.0.0" +0,none,small,no,low,defer +1,none,small,no,medium,defer +2,none,small,no,high,scheduled +3,none,small,no,very high,scheduled +4,none,small,yes,low,defer +5,none,small,yes,medium,scheduled +6,none,small,yes,high,scheduled +7,none,small,yes,very high,scheduled +8,none,controlled,no,low,defer +9,none,controlled,no,medium,scheduled +10,none,controlled,no,high,scheduled +11,none,controlled,no,very high,scheduled +12,none,controlled,yes,low,scheduled +13,none,controlled,yes,medium,scheduled +14,none,controlled,yes,high,scheduled +15,none,controlled,yes,very high,scheduled +16,none,open,no,low,defer +17,none,open,no,medium,scheduled +18,none,open,no,high,scheduled +19,none,open,no,very high,scheduled +20,none,open,yes,low,scheduled +21,none,open,yes,medium,scheduled +22,none,open,yes,high,scheduled +23,none,open,yes,very high,out-of-cycle +24,public poc,small,no,low,defer +25,public poc,small,no,medium,scheduled +26,public poc,small,no,high,scheduled +27,public poc,small,no,very high,scheduled +28,public poc,small,yes,low,scheduled +29,public poc,small,yes,medium,scheduled +30,public poc,small,yes,high,scheduled +31,public poc,small,yes,very high,scheduled +32,public poc,controlled,no,low,defer +33,public poc,controlled,no,medium,scheduled +34,public poc,controlled,no,high,scheduled +35,public poc,controlled,no,very high,scheduled +36,public poc,controlled,yes,low,scheduled +37,public poc,controlled,yes,medium,scheduled +38,public poc,controlled,yes,high,scheduled +39,public poc,controlled,yes,very high,out-of-cycle +40,public poc,open,no,low,scheduled +41,public poc,open,no,medium,scheduled +42,public poc,open,no,high,scheduled +43,public poc,open,no,very high,out-of-cycle +44,public poc,open,yes,low,scheduled +45,public poc,open,yes,medium,scheduled +46,public poc,open,yes,high,out-of-cycle +47,public poc,open,yes,very high,out-of-cycle +48,active,small,no,low,scheduled +49,active,small,no,medium,scheduled +50,active,small,no,high,out-of-cycle +51,active,small,no,very high,out-of-cycle +52,active,small,yes,low,scheduled +53,active,small,yes,medium,out-of-cycle +54,active,small,yes,high,out-of-cycle +55,active,small,yes,very high,out-of-cycle +56,active,controlled,no,low,scheduled +57,active,controlled,no,medium,scheduled +58,active,controlled,no,high,out-of-cycle +59,active,controlled,no,very high,out-of-cycle +60,active,controlled,yes,low,out-of-cycle +61,active,controlled,yes,medium,out-of-cycle +62,active,controlled,yes,high,out-of-cycle +63,active,controlled,yes,very high,out-of-cycle +64,active,open,no,low,scheduled +65,active,open,no,medium,out-of-cycle +66,active,open,no,high,out-of-cycle +67,active,open,no,very high,immediate +68,active,open,yes,low,out-of-cycle +69,active,open,yes,medium,out-of-cycle +70,active,open,yes,high,immediate +71,active,open,yes,very high,immediate diff --git a/data/csv/ssvc/human_impact_1_0_0.csv b/data/csv/ssvc/human_impact_1_0_0.csv new file mode 100644 index 00000000..9aa064d9 --- /dev/null +++ b/data/csv/ssvc/human_impact_1_0_0.csv @@ -0,0 +1,17 @@ +row,Safety Impact v2.0.1,Mission Impact v2.0.0,Human Impact v2.0.2 +0,negligible,degraded,low +1,negligible,mef support crippled,low +2,negligible,mef failure,medium +3,negligible,mission failure,very high +4,marginal,degraded,low +5,marginal,mef support crippled,low +6,marginal,mef failure,medium +7,marginal,mission failure,very high +8,critical,degraded,medium +9,critical,mef support crippled,high +10,critical,mef failure,high +11,critical,mission failure,very high +12,catastrophic,degraded,very high +13,catastrophic,mef support crippled,very high +14,catastrophic,mef failure,very high +15,catastrophic,mission failure,very high diff --git a/data/csv/ssvc/public_safety_impact_1_0_0.csv b/data/csv/ssvc/public_safety_impact_1_0_0.csv new file mode 100644 index 00000000..bc8274c5 --- /dev/null +++ b/data/csv/ssvc/public_safety_impact_1_0_0.csv @@ -0,0 +1,5 @@ +row,Safety Impact v2.0.1,Public Safety Impact v2.0.1 +0,negligible,minimal +1,marginal,significant +2,critical,significant +3,catastrophic,significant diff --git a/data/csv/ssvc/supplier_patch_development_priority_1_0_0.csv b/data/csv/ssvc/supplier_patch_development_priority_1_0_0.csv new file mode 100644 index 00000000..b3a02936 --- /dev/null +++ b/data/csv/ssvc/supplier_patch_development_priority_1_0_0.csv @@ -0,0 +1,37 @@ +row,Exploitation v1.1.0,Utility v1.0.1,Technical Impact v1.0.0,Public Safety Impact v2.0.1,"Defer, Scheduled, Out-of-Cycle, Immediate v1.0.0" +0,none,laborious,partial,minimal,defer +1,none,laborious,partial,significant,scheduled +2,none,laborious,total,minimal,scheduled +3,none,laborious,total,significant,out-of-cycle +4,none,efficient,partial,minimal,scheduled +5,none,efficient,partial,significant,out-of-cycle +6,none,efficient,total,minimal,scheduled +7,none,efficient,total,significant,out-of-cycle +8,none,super effective,partial,minimal,scheduled +9,none,super effective,partial,significant,out-of-cycle +10,none,super effective,total,minimal,out-of-cycle +11,none,super effective,total,significant,out-of-cycle +12,public poc,laborious,partial,minimal,scheduled +13,public poc,laborious,partial,significant,out-of-cycle +14,public poc,laborious,total,minimal,scheduled +15,public poc,laborious,total,significant,immediate +16,public poc,efficient,partial,minimal,scheduled +17,public poc,efficient,partial,significant,immediate +18,public poc,efficient,total,minimal,out-of-cycle +19,public poc,efficient,total,significant,immediate +20,public poc,super effective,partial,minimal,out-of-cycle +21,public poc,super effective,partial,significant,immediate +22,public poc,super effective,total,minimal,out-of-cycle +23,public poc,super effective,total,significant,immediate +24,active,laborious,partial,minimal,out-of-cycle +25,active,laborious,partial,significant,immediate +26,active,laborious,total,minimal,out-of-cycle +27,active,laborious,total,significant,immediate +28,active,efficient,partial,minimal,out-of-cycle +29,active,efficient,partial,significant,immediate +30,active,efficient,total,minimal,out-of-cycle +31,active,efficient,total,significant,immediate +32,active,super effective,partial,minimal,immediate +33,active,super effective,partial,significant,immediate +34,active,super effective,total,minimal,immediate +35,active,super effective,total,significant,immediate diff --git a/data/csv/ssvc/utility_1_0_0.csv b/data/csv/ssvc/utility_1_0_0.csv new file mode 100644 index 00000000..5bdd4fcc --- /dev/null +++ b/data/csv/ssvc/utility_1_0_0.csv @@ -0,0 +1,5 @@ +row,Automatable v2.0.0,Value Density v1.0.0,Utility v1.0.1 +0,no,diffuse,laborious +1,no,concentrated,efficient +2,yes,diffuse,efficient +3,yes,concentrated,super effective diff --git a/data/csvs b/data/csvs new file mode 120000 index 00000000..c3f45170 --- /dev/null +++ b/data/csvs @@ -0,0 +1 @@ +csv \ No newline at end of file diff --git a/data/csvs/README b/data/csvs/README deleted file mode 100644 index 6985a664..00000000 --- a/data/csvs/README +++ /dev/null @@ -1,10 +0,0 @@ -These delimter separated lists are for convenience. -If there is a conflict with an associated JSON schema, the JSON takes precedence. - -A skeleton for filling in a csv table can be generated using ../src/enumerate*.sh -That is mostly useful if you want to customize your risk posture by changing the priority for some situations. - -These CSV files are used as input to ../src/SSVC_csv-to-latex.py as part of the pipeline for creating the pretty static images of the trees used in the PDF document. - -The folder child_trees contain CSV files that contribute to a Combined Value of two child decision points for e.g., the Human Impact is a combination of Situated Safety Impact and Mission Impact. In the future these will be created a Child trees in SSVC schema. - diff --git a/data/csvs/child_trees/human-impact.csv b/data/csvs/child_trees/human-impact.csv deleted file mode 100644 index 03c75179..00000000 --- a/data/csvs/child_trees/human-impact.csv +++ /dev/null @@ -1,21 +0,0 @@ - Situated Safety Impact , Mission Impact , Human Impact - None , Degraded , Low - None , Crippled , Low - None , MEF Failure , Medium - None , Mission Failure , Very High - Minor , Degraded , Low - Minor , Crippled , Low - Minor , MEF Failure , Medium - Minor , Mission Failure , Very High - Major , Degraded , Medium - Major , Crippled , Medium - Major , MEF Failure , High - Major , Mission Failure , Very High - Hazardous , Degraded , High - Hazardous , Crippled , High - Hazardous , MEF Failure , High - Hazardous , Mission Failure , Very High - Catastrophic , Degraded , Very High - Catastrophic , Crippled , Very High - Catastrophic , MEF Failure , Very High - Catastrophic , Mission Failure , Very High diff --git a/data/csvs/child_trees/mission-and-well-being.csv b/data/csvs/child_trees/mission-and-well-being.csv deleted file mode 100644 index f24af30c..00000000 --- a/data/csvs/child_trees/mission-and-well-being.csv +++ /dev/null @@ -1,10 +0,0 @@ -Mission Prevalence , Public Well-being Impact , Mission and Well-being Impact -minimal , minimal , low -minimal , material , medium -minimal , irreversible, high -support , minimal , medium -support , material , medium -support , irreversible, high -essential , minimal , high -essential , material , high -essential , irreversible, high diff --git a/data/csvs/child_trees/utility.csv b/data/csvs/child_trees/utility.csv deleted file mode 100644 index 15b6e6e8..00000000 --- a/data/csvs/child_trees/utility.csv +++ /dev/null @@ -1,5 +0,0 @@ - Automatable , Value Density , Utility - no , diffuse , laborious - no , concentrated , efficient - yes , diffuse , efficient - yes , concentrated , super effective diff --git a/data/csvs/coord-publish-options.csv b/data/csvs/coord-publish-options.csv deleted file mode 100644 index 10da468e..00000000 --- a/data/csvs/coord-publish-options.csv +++ /dev/null @@ -1,28 +0,0 @@ -row,Supplier involvement,Exploitation,Value added,Priority -1,fix ready,none,precedence,publish -2,fix ready,none,ampliative,don't publish -3,fix ready,none,limited,don't publish -4,fix ready,PoC,precedence,publish -5,fix ready,PoC,ampliative,don't publish -6,fix ready,PoC,limited,don't publish -7,fix ready,active,precedence,publish -8,fix ready,active,ampliative,publish -9,fix ready,active,limited,don't publish -10,cooperative,none,precedence,publish -11,cooperative,none,ampliative,don't publish -12,cooperative,none,limited,don't publish -13,cooperative,PoC,precedence,publish -14,cooperative,PoC,ampliative,don't publish -15,cooperative,PoC,limited,don't publish -16,cooperative,active,precedence,publish -17,cooperative,active,ampliative,publish -18,cooperative,active,limited,don't publish -19,uncoop/unresponsive,none,precedence,publish -20,uncoop/unresponsive,none,ampliative,don't publish -21,uncoop/unresponsive,none,limited,don't publish -22,uncoop/unresponsive,PoC,precedence,publish -23,uncoop/unresponsive,PoC,ampliative,publish -24,uncoop/unresponsive,PoC,limited,don't publish -25,uncoop/unresponsive,active,precedence,publish -26,uncoop/unresponsive,active,ampliative,publish -27,uncoop/unresponsive,active,limited,publish diff --git a/data/csvs/coord-triage-options.csv b/data/csvs/coord-triage-options.csv deleted file mode 100644 index 4f40e1d1..00000000 --- a/data/csvs/coord-triage-options.csv +++ /dev/null @@ -1,85 +0,0 @@ -row,Public,Contacted,Report_Credibility,Cardinality,Engagement,Utility,Public_Safety_Impact,Priority -1,no,yes,no,one,active,laborious,minimal,decline -2,no,yes,no,one,active,laborious,significant,decline -3,no,yes,no,one,active,efficient,minimal,decline -4,no,yes,no,one,active,efficient,significant,track -5,no,yes,no,one,active,super effective,minimal,decline -6,no,yes,no,one,active,super effective,significant,track -7,no,yes,no,one,unresponsive,laborious,minimal,decline -8,no,yes,no,one,unresponsive,laborious,significant,decline -9,no,yes,no,one,unresponsive,efficient,minimal,decline -10,no,yes,no,one,unresponsive,efficient,significant,track -11,no,yes,no,one,unresponsive,super effective,minimal,decline -12,no,yes,no,one,unresponsive,super effective,significant,track -13,no,yes,no,multiple,active,laborious,minimal,decline -14,no,yes,no,multiple,active,laborious,significant,track -15,no,yes,no,multiple,active,efficient,minimal,decline -16,no,yes,no,multiple,active,efficient,significant,track -17,no,yes,no,multiple,active,super effective,minimal,track -18,no,yes,no,multiple,active,super effective,significant,coordinate -19,no,yes,no,multiple,unresponsive,laborious,minimal,decline -20,no,yes,no,multiple,unresponsive,laborious,significant,track -21,no,yes,no,multiple,unresponsive,efficient,minimal,decline -22,no,yes,no,multiple,unresponsive,efficient,significant,track -23,no,yes,no,multiple,unresponsive,super effective,minimal,track -24,no,yes,no,multiple,unresponsive,super effective,significant,coordinate -25,no,yes,yes,one,active,laborious,minimal,decline -26,no,yes,yes,one,active,laborious,significant,decline -27,no,yes,yes,one,active,efficient,minimal,decline -28,no,yes,yes,one,active,efficient,significant,track -29,no,yes,yes,one,active,super effective,minimal,decline -30,no,yes,yes,one,active,super effective,significant,track -31,no,yes,yes,one,unresponsive,laborious,minimal,track -32,no,yes,yes,one,unresponsive,laborious,significant,coordinate -33,no,yes,yes,one,unresponsive,efficient,minimal,coordinate -34,no,yes,yes,one,unresponsive,efficient,significant,coordinate -35,no,yes,yes,one,unresponsive,super effective,minimal,coordinate -36,no,yes,yes,one,unresponsive,super effective,significant,coordinate -37,no,yes,yes,multiple,active,laborious,minimal,decline -38,no,yes,yes,multiple,active,laborious,significant,track -39,no,yes,yes,multiple,active,efficient,minimal,decline -40,no,yes,yes,multiple,active,efficient,significant,track -41,no,yes,yes,multiple,active,super effective,minimal,coordinate -42,no,yes,yes,multiple,active,super effective,significant,coordinate -43,no,yes,yes,multiple,unresponsive,laborious,minimal,coordinate -44,no,yes,yes,multiple,unresponsive,laborious,significant,coordinate -45,no,yes,yes,multiple,unresponsive,efficient,minimal,coordinate -46,no,yes,yes,multiple,unresponsive,efficient,significant,coordinate -47,no,yes,yes,multiple,unresponsive,super effective,minimal,coordinate -48,no,yes,yes,multiple,unresponsive,super effective,significant,coordinate -49,yes,yes,no,multiple,active,super effective,significant,coordinate -50,yes,yes,no,multiple,unresponsive,super effective,significant,coordinate -51,yes,yes,yes,multiple,active,super effective,significant,coordinate -52,yes,yes,yes,multiple,unresponsive,super effective,significant,coordinate -53,yes,no,no,multiple,active,super effective,significant,coordinate -54,yes,no,no,multiple,unresponsive,super effective,significant,coordinate -55,yes,no,yes,multiple,active,super effective,significant,coordinate -56,yes,no,yes,multiple,unresponsive,super effective,significant,coordinate -57,yes,yes,no,one,active,laborious,minimal,decline -58,yes,yes,no,one,active,efficient,minimal,decline -59,yes,yes,no,one,unresponsive,laborious,minimal,decline -60,yes,yes,no,one,unresponsive,efficient,minimal,decline -61,yes,yes,yes,one,active,laborious,minimal,decline -62,yes,yes,yes,one,active,efficient,minimal,decline -63,yes,yes,yes,one,unresponsive,laborious,minimal,decline -64,yes,yes,yes,one,unresponsive,efficient,minimal,decline -65,yes,no,no,one,active,laborious,minimal,decline -66,yes,no,no,one,active,efficient,minimal,decline -67,yes,no,no,one,unresponsive,laborious,minimal,decline -68,yes,no,no,one,unresponsive,efficient,minimal,decline -69,yes,no,yes,one,active,laborious,minimal,decline -70,yes,no,yes,one,active,efficient,minimal,decline -71,yes,no,yes,one,unresponsive,laborious,minimal,decline -72,yes,no,yes,one,unresponsive,efficient,minimal,decline -73,no,no,no,multiple,active,super effective,significant,coordinate -74,no,no,no,multiple,unresponsive,super effective,significant,coordinate -75,no,no,yes,multiple,active,super effective,significant,coordinate -76,no,no,yes,multiple,unresponsive,super effective,significant,coordinate -77,no,no,no,one,active,laborious,minimal,decline -78,no,no,no,one,active,efficient,minimal,decline -79,no,no,no,one,unresponsive,laborious,minimal,decline -80,no,no,no,one,unresponsive,efficient,minimal,decline -81,no,no,yes,one,active,laborious,minimal,decline -82,no,no,yes,one,active,efficient,minimal,decline -83,no,no,yes,one,unresponsive,laborious,minimal,decline -84,no,no,yes,one,unresponsive,efficient,minimal,decline diff --git a/data/csvs/deployer-options.csv b/data/csvs/deployer-options.csv deleted file mode 100644 index 6b9a8791..00000000 --- a/data/csvs/deployer-options.csv +++ /dev/null @@ -1,73 +0,0 @@ -row,Exploitation,Exposure,Automatable,Human Impact,Priority -1,none,small,no,low,defer -2,none,small,no,medium,defer -3,none,small,no,high,scheduled -4,none,small,no,very high,scheduled -5,none,small,yes,low,defer -6,none,small,yes,medium,scheduled -7,none,small,yes,high,scheduled -8,none,small,yes,very high,scheduled -9,none,controlled,no,low,defer -10,none,controlled,no,medium,scheduled -11,none,controlled,no,high,scheduled -12,none,controlled,no,very high,scheduled -13,none,controlled,yes,low,scheduled -14,none,controlled,yes,medium,scheduled -15,none,controlled,yes,high,scheduled -16,none,controlled,yes,very high,scheduled -17,none,open,no,low,defer -18,none,open,no,medium,scheduled -19,none,open,no,high,scheduled -20,none,open,no,very high,scheduled -21,none,open,yes,low,scheduled -22,none,open,yes,medium,scheduled -23,none,open,yes,high,scheduled -24,none,open,yes,very high,out-of-cycle -25,PoC,small,no,low,defer -26,PoC,small,no,medium,scheduled -27,PoC,small,no,high,scheduled -28,PoC,small,no,very high,scheduled -29,PoC,small,yes,low,scheduled -30,PoC,small,yes,medium,scheduled -31,PoC,small,yes,high,scheduled -32,PoC,small,yes,very high,scheduled -33,PoC,controlled,no,low,defer -34,PoC,controlled,no,medium,scheduled -35,PoC,controlled,no,high,scheduled -36,PoC,controlled,no,very high,scheduled -37,PoC,controlled,yes,low,scheduled -38,PoC,controlled,yes,medium,scheduled -39,PoC,controlled,yes,high,scheduled -40,PoC,controlled,yes,very high,out-of-cycle -41,PoC,open,no,low,scheduled -42,PoC,open,no,medium,scheduled -43,PoC,open,no,high,scheduled -44,PoC,open,no,very high,out-of-cycle -45,PoC,open,yes,low,scheduled -46,PoC,open,yes,medium,scheduled -47,PoC,open,yes,high,out-of-cycle -48,PoC,open,yes,very high,out-of-cycle -49,active,small,no,low,scheduled -50,active,small,no,medium,scheduled -51,active,small,no,high,out-of-cycle -52,active,small,no,very high,out-of-cycle -53,active,small,yes,low,scheduled -54,active,small,yes,medium,out-of-cycle -55,active,small,yes,high,out-of-cycle -56,active,small,yes,very high,out-of-cycle -57,active,controlled,no,low,scheduled -58,active,controlled,no,medium,scheduled -59,active,controlled,no,high,out-of-cycle -60,active,controlled,no,very high,out-of-cycle -61,active,controlled,yes,low,out-of-cycle -62,active,controlled,yes,medium,out-of-cycle -63,active,controlled,yes,high,out-of-cycle -64,active,controlled,yes,very high,out-of-cycle -65,active,open,no,low,scheduled -66,active,open,no,medium,out-of-cycle -67,active,open,no,high,out-of-cycle -68,active,open,no,very high,immediate -69,active,open,yes,low,out-of-cycle -70,active,open,yes,medium,out-of-cycle -71,active,open,yes,high,immediate -72,active,open,yes,very high,immediate diff --git a/data/csvs/mapped_trees/public-safety-impact.csv b/data/csvs/mapped_trees/public-safety-impact.csv deleted file mode 100644 index fdf6859a..00000000 --- a/data/csvs/mapped_trees/public-safety-impact.csv +++ /dev/null @@ -1,6 +0,0 @@ -Safety Impact , Public Safety Impact -none , minimal -minor , minimal -major , significant -hazardous , significant -catastrophic , significant diff --git a/data/csvs/supplier-options.csv b/data/csvs/supplier-options.csv deleted file mode 100644 index 72148dd8..00000000 --- a/data/csvs/supplier-options.csv +++ /dev/null @@ -1,37 +0,0 @@ -row,Exploitation,Utility,Technical Impact,Public-Safety Impact,Priority -1,none,laborious,partial,minimal,defer -2,none,laborious,partial,significant,scheduled -3,none,laborious,total,minimal,scheduled -4,none,laborious,total,significant,out-of-cycle -5,none,efficient,partial,minimal,scheduled -6,none,efficient,partial,significant,out-of-cycle -7,none,efficient,total,minimal,scheduled -8,none,efficient,total,significant,out-of-cycle -9,none,super effective,partial,minimal,scheduled -10,none,super effective,partial,significant,out-of-cycle -11,none,super effective,total,minimal,out-of-cycle -12,none,super effective,total,significant,out-of-cycle -13,PoC,laborious,partial,minimal,scheduled -14,PoC,laborious,partial,significant,out-of-cycle -15,PoC,laborious,total,minimal,scheduled -16,PoC,laborious,total,significant,immediate -17,PoC,efficient,partial,minimal,scheduled -18,PoC,efficient,partial,significant,immediate -19,PoC,efficient,total,minimal,out-of-cycle -20,PoC,efficient,total,significant,immediate -21,PoC,super effective,partial,minimal,out-of-cycle -22,PoC,super effective,partial,significant,immediate -23,PoC,super effective,total,minimal,out-of-cycle -24,PoC,super effective,total,significant,immediate -25,active,laborious,partial,minimal,out-of-cycle -26,active,laborious,partial,significant,immediate -27,active,laborious,total,minimal,out-of-cycle -28,active,laborious,total,significant,immediate -29,active,efficient,partial,minimal,out-of-cycle -30,active,efficient,partial,significant,immediate -31,active,efficient,total,minimal,out-of-cycle -32,active,efficient,total,significant,immediate -33,active,super effective,partial,minimal,immediate -34,active,super effective,partial,significant,immediate -35,active,super effective,total,minimal,immediate -36,active,super effective,total,significant,immediate diff --git a/data/json/decision_points/automatable_2_0_0.json b/data/json/decision_points/automatable_2_0_0.json deleted file mode 100644 index 5a0528d8..00000000 --- a/data/json/decision_points/automatable_2_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Automatable", - "description": "Can an attacker reliably automate creating exploitation events for this vulnerability?", - "namespace": "ssvc", - "version": "2.0.0", - "schemaVersion": "1-0-1", - "key": "A", - "values": [ - { - "key": "N", - "name": "No", - "description": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." - }, - { - "key": "Y", - "name": "Yes", - "description": "Attackers can reliably automate steps 1-4 of the kill chain." - } - ] -} diff --git a/data/json/decision_points/basic/boundary_proximity_1_0_0.json b/data/json/decision_points/basic/boundary_proximity_1_0_0.json new file mode 100644 index 00000000..6ac74b82 --- /dev/null +++ b/data/json/decision_points/basic/boundary_proximity_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "basic", + "key": "BP", + "version": "1.0.0", + "name": "Boundary Proximity", + "definition": "Indicates whether another value is near a boundary condition, indicating that special consideration may be needed.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "NN", + "name": "Not Near Boundary", + "definition": "The value is not near a boundary condition" + }, + { + "key": "JA", + "name": "Just Above Boundary", + "definition": "The value is just above a boundary condition" + }, + { + "key": "JB", + "name": "Just Below Boundary", + "definition": "The value is just below a boundary condition" + } + ] +} diff --git a/data/json/decision_points/basic/cis_cti_words_of_estimative_probability_1_0_0.json b/data/json/decision_points/basic/cis_cti_words_of_estimative_probability_1_0_0.json new file mode 100644 index 00000000..58c79f61 --- /dev/null +++ b/data/json/decision_points/basic/cis_cti_words_of_estimative_probability_1_0_0.json @@ -0,0 +1,45 @@ +{ + "namespace": "basic", + "key": "CIS_WEP", + "version": "1.0.0", + "name": "CIS-CTI Words of Estimative Probability", + "definition": "A scale for expressing the likelihood of an event or outcome.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "ANC", + "name": "Almost No Chance", + "definition": "Probability < 0.05. Almost no chance, remote" + }, + { + "key": "VU", + "name": "Very Unlikely", + "definition": "0.05 <= Probability < 0.20. Very unlikely, highly improbable." + }, + { + "key": "U", + "name": "Unlikely", + "definition": "0.20 <= Probability < 0.45. Unlikely, improbable." + }, + { + "key": "REC", + "name": "Roughly Even Chance", + "definition": "0.45 <= Probability < 0.55. Roughly even chance, roughly even odds." + }, + { + "key": "L", + "name": "Likely", + "definition": "0.55 <= Probability < 0.80. Likely, probable." + }, + { + "key": "VL", + "name": "Very Likely", + "definition": "0.80 <= Probability < 0.95. Very likely, highly probable." + }, + { + "key": "AC", + "name": "Almost Certain", + "definition": "0.95 <= Probability. Almost certain, nearly certain." + } + ] +} diff --git a/data/json/outcomes/EISENHOWER.json b/data/json/decision_points/basic/do_schedule_delegate_delete_1_0_0.json similarity index 53% rename from data/json/outcomes/EISENHOWER.json rename to data/json/decision_points/basic/do_schedule_delegate_delete_1_0_0.json index 40d98902..49c5dd0d 100644 --- a/data/json/outcomes/EISENHOWER.json +++ b/data/json/decision_points/basic/do_schedule_delegate_delete_1_0_0.json @@ -1,28 +1,30 @@ { + "namespace": "basic", + "key": "IKE", "version": "1.0.0", - "schemaVersion": "1-0-1", "name": "Do, Schedule, Delegate, Delete", - "description": "The Eisenhower outcome group.", - "outcomes": [ + "definition": "The Eisenhower outcome group.", + "schemaVersion": "2.0.0", + "values": [ { "key": "D", "name": "Delete", - "description": "Delete" + "definition": "Delete" }, { "key": "G", "name": "Delegate", - "description": "Delegate" + "definition": "Delegate" }, { "key": "S", "name": "Schedule", - "description": "Schedule" + "definition": "Schedule" }, { "key": "O", "name": "Do", - "description": "Do" + "definition": "Do" } ] -} \ No newline at end of file +} diff --git a/data/json/decision_points/basic/lowmediumhigh_1_0_0.json b/data/json/decision_points/basic/lowmediumhigh_1_0_0.json new file mode 100644 index 00000000..3cfd0a8f --- /dev/null +++ b/data/json/decision_points/basic/lowmediumhigh_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "basic", + "key": "LMH", + "version": "1.0.0", + "name": "LowMediumHigh", + "definition": "A Low/Medium/High decision point / outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Low" + }, + { + "key": "M", + "name": "Medium", + "definition": "Medium" + }, + { + "key": "H", + "name": "High", + "definition": "High" + } + ] +} diff --git a/data/json/decision_points/basic/median_split_1_0_0.json b/data/json/decision_points/basic/median_split_1_0_0.json new file mode 100644 index 00000000..b97933e8 --- /dev/null +++ b/data/json/decision_points/basic/median_split_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "basic", + "key": "MEDIAN", + "version": "1.0.0", + "name": "Median Split", + "definition": "A median split divides a distribution into two equal parts, with 50% of the values falling below the median and 50% above it.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "B", + "name": "Below Median", + "definition": "Quantile < 0.50. The lower half of the range of possible values." + }, + { + "key": "A", + "name": "Above Median", + "definition": "0.50 <= Quantile <= 1.0. The upper half of the range of possible values." + } + ] +} diff --git a/data/json/decision_points/basic/moscow_1_0_0.json b/data/json/decision_points/basic/moscow_1_0_0.json new file mode 100644 index 00000000..ce8ddcba --- /dev/null +++ b/data/json/decision_points/basic/moscow_1_0_0.json @@ -0,0 +1,30 @@ +{ + "namespace": "basic", + "key": "MSCW", + "version": "1.0.0", + "name": "MoSCoW", + "definition": "The MoSCoW (Must, Should, Could, Won't) outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "W", + "name": "Won't", + "definition": "Won't" + }, + { + "key": "C", + "name": "Could", + "definition": "Could" + }, + { + "key": "S", + "name": "Should", + "definition": "Should" + }, + { + "key": "M", + "name": "Must", + "definition": "Must" + } + ] +} diff --git a/data/json/decision_points/basic/probability_scale_in_2_equal_levels_ascending_1_0_0.json b/data/json/decision_points/basic/probability_scale_in_2_equal_levels_ascending_1_0_0.json new file mode 100644 index 00000000..b0ee12b3 --- /dev/null +++ b/data/json/decision_points/basic/probability_scale_in_2_equal_levels_ascending_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "basic", + "key": "P_2A", + "version": "1.0.0", + "name": "Probability Scale in 2 equal levels, ascending", + "definition": "A probability scale that divides between less than 50% and greater than or equal to 50%", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "LT50", + "name": "Less than 50%", + "definition": "0.0 <= Probability < 0.5" + }, + { + "key": "GT50", + "name": "Greater than 50%", + "definition": "0.5 <= Probability <= 1.0" + } + ] +} diff --git a/data/json/decision_points/basic/probability_scale_in_5_equal_levels_ascending_1_0_0.json b/data/json/decision_points/basic/probability_scale_in_5_equal_levels_ascending_1_0_0.json new file mode 100644 index 00000000..0929b714 --- /dev/null +++ b/data/json/decision_points/basic/probability_scale_in_5_equal_levels_ascending_1_0_0.json @@ -0,0 +1,35 @@ +{ + "namespace": "basic", + "key": "P_5A", + "version": "1.0.0", + "name": "Probability Scale in 5 equal levels, ascending", + "definition": "A probability scale with 20% increments", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P0_20", + "name": "Less than 20%", + "definition": "Probability < 0.2" + }, + { + "key": "P20_40", + "name": "20% to 40%", + "definition": "0.2 <= Probability < 0.4" + }, + { + "key": "P40_60", + "name": "40% to 60%", + "definition": "0.4 <= Probability < 0.6" + }, + { + "key": "P60_80", + "name": "60% to 80%", + "definition": "0.6 <= Probability < 0.8" + }, + { + "key": "P80_100", + "name": "Greater than 80%", + "definition": "0.8 <= Probability <= 1.0" + } + ] +} diff --git a/data/json/decision_points/basic/probability_scale_in_5_weighted_levels_ascending_1_0_0.json b/data/json/decision_points/basic/probability_scale_in_5_weighted_levels_ascending_1_0_0.json new file mode 100644 index 00000000..bcefa963 --- /dev/null +++ b/data/json/decision_points/basic/probability_scale_in_5_weighted_levels_ascending_1_0_0.json @@ -0,0 +1,35 @@ +{ + "namespace": "basic", + "key": "P_5W", + "version": "1.0.0", + "name": "Probability Scale in 5 weighted levels, ascending", + "definition": "A probability scale with higher resolution as probability increases", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P0_30", + "name": "Less than 30%", + "definition": "Probability < 0.3" + }, + { + "key": "P30_55", + "name": "30% to 55%", + "definition": "0.3 <= Probability < 0.55" + }, + { + "key": "P55_75", + "name": "55% to 75%", + "definition": "0.55 <= Probability < 0.75" + }, + { + "key": "P75_90", + "name": "75% to 90%", + "definition": "0.75 <= Probability < 0.9" + }, + { + "key": "P90_100", + "name": "Greater than 90%", + "definition": "0.9 <= Probability <= 1.0" + } + ] +} diff --git a/data/json/decision_points/basic/quartiles_1_0_0.json b/data/json/decision_points/basic/quartiles_1_0_0.json new file mode 100644 index 00000000..1766d02f --- /dev/null +++ b/data/json/decision_points/basic/quartiles_1_0_0.json @@ -0,0 +1,30 @@ +{ + "namespace": "basic", + "key": "QUARTILES", + "version": "1.0.0", + "name": "Quartiles", + "definition": "A quartile is one of four equal groups that a population can be divided into according to the distribution of values of a particular variable.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "Q1", + "name": "First Quartile", + "definition": "Quantile < 0.25. The lowest 25% of the range of possible values." + }, + { + "key": "Q2", + "name": "Second Quartile", + "definition": "0.25 <= Quantile < 0.50. The second lowest 25% of the range of possible values." + }, + { + "key": "Q3", + "name": "Third Quartile", + "definition": "0.50 <= Quantile < 0.75. The second highest 25% of the range of possible values." + }, + { + "key": "Q4", + "name": "Fourth Quartile", + "definition": "0.75 <= Quantile <= 1.0. The highest 25% of the range of possible values." + } + ] +} diff --git a/data/json/decision_points/basic/quintiles_1_0_0.json b/data/json/decision_points/basic/quintiles_1_0_0.json new file mode 100644 index 00000000..f044687c --- /dev/null +++ b/data/json/decision_points/basic/quintiles_1_0_0.json @@ -0,0 +1,35 @@ +{ + "namespace": "basic", + "key": "QUINTILES", + "version": "1.0.0", + "name": "Quintiles", + "definition": "A quintile is one of five equal groups that a population can be divided into according to the distribution of values of a particular variable.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "Q1", + "name": "First Quintile", + "definition": "Quantile < 0.20. The lowest 20% of the range of possible values." + }, + { + "key": "Q2", + "name": "Second Quintile", + "definition": "0.20 <= Quantile < 0.40. The second lowest 20% of the range of possible values." + }, + { + "key": "Q3", + "name": "Third Quintile", + "definition": "0.40 <= Quantile < 0.60. The middle 20% of the range of possible values." + }, + { + "key": "Q4", + "name": "Fourth Quintile", + "definition": "0.60 <= Quantile < 0.80. The second highest 20% of the range of possible values." + }, + { + "key": "Q5", + "name": "Fifth Quintile", + "definition": "0.80 <= Quantile <= 1.0. The highest 20% of the range of possible values." + } + ] +} diff --git a/data/json/outcomes/VALUE_COMPLEXITY.json b/data/json/decision_points/basic/value_complexity_1_0_0.json similarity index 50% rename from data/json/outcomes/VALUE_COMPLEXITY.json rename to data/json/decision_points/basic/value_complexity_1_0_0.json index b60d42f8..11c0fc20 100644 --- a/data/json/outcomes/VALUE_COMPLEXITY.json +++ b/data/json/decision_points/basic/value_complexity_1_0_0.json @@ -1,28 +1,30 @@ { + "namespace": "basic", + "key": "VALUE_COMPLEXITY", "version": "1.0.0", - "schemaVersion": "1-0-1", "name": "Value, Complexity", - "description": "The Value/Complexity outcome group.", - "outcomes": [ + "definition": "The Value/Complexity outcome group.", + "schemaVersion": "2.0.0", + "values": [ { "key": "D", "name": "Drop", - "description": "Drop" + "definition": "Drop" }, { "key": "R", "name": "Reconsider Later", - "description": "Reconsider Later" + "definition": "Reconsider Later" }, { "key": "E", "name": "Easy Win", - "description": "Easy Win" + "definition": "Easy Win" }, { "key": "F", "name": "Do First", - "description": "Do First" + "definition": "Do First" } ] -} \ No newline at end of file +} diff --git a/data/json/decision_points/basic/yesno_1_0_0.json b/data/json/decision_points/basic/yesno_1_0_0.json new file mode 100644 index 00000000..d177d2cf --- /dev/null +++ b/data/json/decision_points/basic/yesno_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "basic", + "key": "YN", + "version": "1.0.0", + "name": "YesNo", + "definition": "A Yes/No decision point / outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "No" + }, + { + "key": "Y", + "name": "Yes", + "definition": "Yes" + } + ] +} diff --git a/data/json/decision_points/cisa/cisa_levels_1_1_0.json b/data/json/decision_points/cisa/cisa_levels_1_1_0.json new file mode 100644 index 00000000..7633ec00 --- /dev/null +++ b/data/json/decision_points/cisa/cisa_levels_1_1_0.json @@ -0,0 +1,30 @@ +{ + "namespace": "cisa", + "key": "CISA", + "version": "1.1.0", + "name": "CISA Levels", + "definition": "The CISA outcome group. CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Track*, Attend, and Act.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "T", + "name": "Track", + "definition": "The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines." + }, + { + "key": "T*", + "name": "Track*", + "definition": "The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines." + }, + { + "key": "AT", + "name": "Attend", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines." + }, + { + "key": "AC", + "name": "Act", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible." + } + ] +} diff --git a/data/json/decision_points/cisa/in_kev_1_0_0.json b/data/json/decision_points/cisa/in_kev_1_0_0.json new file mode 100644 index 00000000..5431bbd0 --- /dev/null +++ b/data/json/decision_points/cisa/in_kev_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "cisa", + "key": "KEV", + "version": "1.0.0", + "name": "In KEV", + "definition": "Denotes whether a vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) list.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Vulnerability is not listed in KEV." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Vulnerability is listed in KEV." + } + ] +} diff --git a/data/json/decision_points/cisa/mission_prevalence_1_0_0.json b/data/json/decision_points/cisa/mission_prevalence_1_0_0.json new file mode 100644 index 00000000..07546241 --- /dev/null +++ b/data/json/decision_points/cisa/mission_prevalence_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "cisa", + "key": "MP", + "version": "1.0.0", + "name": "Mission Prevalence", + "definition": "Prevalence of the mission essential functions", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Neither Support nor Essential apply. The vulnerable component may be used within the entities, but it is not used as a mission-essential component, nor does it provide impactful support to mission-essential functions." + }, + { + "key": "S", + "name": "Support", + "definition": "The vulnerable component only supports MEFs for two or more entities." + }, + { + "key": "E", + "name": "Essential", + "definition": "The vulnerable component directly provides capabilities that constitute at least one MEF for at least one entity; component failure may (but does not necessarily) lead to overall mission failure." + } + ] +} diff --git a/data/json/decision_points/cvss/access_complexity_1_0_0.json b/data/json/decision_points/cvss/access_complexity_1_0_0.json index b07e7595..41063a4b 100644 --- a/data/json/decision_points/cvss/access_complexity_1_0_0.json +++ b/data/json/decision_points/cvss/access_complexity_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "Access Complexity", - "description": "This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "AC", + "version": "1.0.0", + "name": "Access Complexity", + "definition": "This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.", + "schemaVersion": "2.0.0", "values": [ - { - "key": "L", - "name": "Low", - "description": "Specialized access conditions or extenuating circumstances do not exist; the system is always exploitable." - }, { "key": "H", "name": "High", - "description": "Specialized access conditions exist; for example: the system is exploitable during specific windows of time (a race condition), the system is exploitable under specific circumstances (nondefault configurations), or the system is exploitable with victim interaction (vulnerability exploitable only if user opens e-mail)" + "definition": "Specialized access conditions exist; for example: the system is exploitable during specific windows of time (a race condition), the system is exploitable under specific circumstances (nondefault configurations), or the system is exploitable with victim interaction (vulnerability exploitable only if user opens e-mail)" + }, + { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist; the system is always exploitable." } ] } diff --git a/data/json/decision_points/cvss/access_complexity_2_0_0.json b/data/json/decision_points/cvss/access_complexity_2_0_0.json index 15fec7b8..12b744cc 100644 --- a/data/json/decision_points/cvss/access_complexity_2_0_0.json +++ b/data/json/decision_points/cvss/access_complexity_2_0_0.json @@ -1,25 +1,25 @@ { - "name": "Access Complexity", - "description": "This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "AC", + "version": "2.0.0", + "name": "Access Complexity", + "definition": "This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.", + "schemaVersion": "2.0.0", "values": [ { - "key": "L", - "name": "Low", - "description": "Specialized access conditions or extenuating circumstances do not exist." + "key": "H", + "name": "High", + "definition": "Specialized access conditions exist." }, { "key": "M", "name": "Medium", - "description": "The access conditions are somewhat specialized." + "definition": "The access conditions are somewhat specialized." }, { - "key": "H", - "name": "High", - "description": "Specialized access conditions exist." + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist." } ] } diff --git a/data/json/decision_points/cvss/access_vector_1_0_0.json b/data/json/decision_points/cvss/access_vector_1_0_0.json index 55d6d8c6..f9fced74 100644 --- a/data/json/decision_points/cvss/access_vector_1_0_0.json +++ b/data/json/decision_points/cvss/access_vector_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "Access Vector", - "description": "This metric measures whether or not the vulnerability is exploitable locally or remotely.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "AV", + "version": "1.0.0", + "name": "Access Vector", + "definition": "This metric measures whether or not the vulnerability is exploitable locally or remotely.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Local", - "description": "The vulnerability is only exploitable locally (i.e., it requires physical access or authenticated login to the target system)" + "definition": "The vulnerability is only exploitable locally (i.e., it requires physical access or authenticated login to the target system)" }, { "key": "R", "name": "Remote", - "description": "The vulnerability is exploitable remotely." + "definition": "The vulnerability is exploitable remotely." } ] } diff --git a/data/json/decision_points/cvss/access_vector_2_0_0.json b/data/json/decision_points/cvss/access_vector_2_0_0.json index 14918e5c..ab92b164 100644 --- a/data/json/decision_points/cvss/access_vector_2_0_0.json +++ b/data/json/decision_points/cvss/access_vector_2_0_0.json @@ -1,25 +1,25 @@ { - "name": "Access Vector", - "description": "This metric reflects the context by which vulnerability exploitation is possible.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "AV", + "version": "2.0.0", + "name": "Access Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Local", - "description": "A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account." + "definition": "A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account." }, { "key": "A", "name": "Adjacent Network", - "description": "A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software." + "definition": "A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software." }, { "key": "N", "name": "Network", - "description": "A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed 'remotely exploitable'." + "definition": "A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed 'remotely exploitable'." } ] } diff --git a/data/json/decision_points/cvss/attack_complexity_3_0_0.json b/data/json/decision_points/cvss/attack_complexity_3_0_0.json index e2ef4655..a2ef8eaa 100644 --- a/data/json/decision_points/cvss/attack_complexity_3_0_0.json +++ b/data/json/decision_points/cvss/attack_complexity_3_0_0.json @@ -1,20 +1,20 @@ { - "name": "Attack Complexity", - "description": "This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "AC", + "version": "3.0.0", + "name": "Attack Complexity", + "definition": "This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.", + "schemaVersion": "2.0.0", "values": [ - { - "key": "L", - "name": "Low", - "description": "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component." - }, { "key": "H", "name": "High", - "description": "A successful attack depends on conditions beyond the attacker's control." + "definition": "A successful attack depends on conditions beyond the attacker's control." + }, + { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component." } ] } diff --git a/data/json/decision_points/cvss/attack_complexity_3_0_1.json b/data/json/decision_points/cvss/attack_complexity_3_0_1.json index a3469f1b..9267e9df 100644 --- a/data/json/decision_points/cvss/attack_complexity_3_0_1.json +++ b/data/json/decision_points/cvss/attack_complexity_3_0_1.json @@ -1,20 +1,20 @@ { - "name": "Attack Complexity", - "description": "This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. ", "namespace": "cvss", - "version": "3.0.1", - "schemaVersion": "1-0-1", "key": "AC", + "version": "3.0.1", + "name": "Attack Complexity", + "definition": "This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. ", + "schemaVersion": "2.0.0", "values": [ - { - "key": "L", - "name": "Low", - "description": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " - }, { "key": "H", "name": "High", - "description": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + "definition": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " } ] } diff --git a/data/json/decision_points/cvss/attack_requirements_1_0_0.json b/data/json/decision_points/cvss/attack_requirements_1_0_0.json index eaff05de..8ff48413 100644 --- a/data/json/decision_points/cvss/attack_requirements_1_0_0.json +++ b/data/json/decision_points/cvss/attack_requirements_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "Attack Requirements", - "description": "This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "AT", + "version": "1.0.0", + "name": "Attack Requirements", + "definition": "This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.", + "schemaVersion": "2.0.0", "values": [ - { - "key": "N", - "name": "None", - "description": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." - }, { "key": "P", "name": "Present", - "description": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + "definition": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + }, + { + "key": "N", + "name": "None", + "definition": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." } ] } diff --git a/data/json/decision_points/cvss/attack_vector_3_0_0.json b/data/json/decision_points/cvss/attack_vector_3_0_0.json index 3db17af6..f8415045 100644 --- a/data/json/decision_points/cvss/attack_vector_3_0_0.json +++ b/data/json/decision_points/cvss/attack_vector_3_0_0.json @@ -1,30 +1,30 @@ { - "name": "Attack Vector", - "description": "This metric reflects the context by which vulnerability exploitation is possible. ", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "AV", + "version": "3.0.0", + "name": "Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. ", + "schemaVersion": "2.0.0", "values": [ { "key": "P", "name": "Physical", - "description": "A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent." + "definition": "A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent." }, { "key": "L", "name": "Local", - "description": "A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file." + "definition": "A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file." }, { "key": "A", "name": "Adjacent", - "description": "A vulnerability exploitable with adjacent network access means the vulnerable component is bound to the network stack, however the attack is limited to the same shared physical (e.g. Bluetooth, IEEE 802.11), or logical (e.g. local IP subnet) network, and cannot be performed across an OSI layer 3 boundary (e.g. a router)." + "definition": "A vulnerability exploitable with adjacent network access means the vulnerable component is bound to the network stack, however the attack is limited to the same shared physical (e.g. Bluetooth, IEEE 802.11), or logical (e.g. local IP subnet) network, and cannot be performed across an OSI layer 3 boundary (e.g. a router)." }, { "key": "N", "name": "Network", - "description": "A vulnerability exploitable with network access means the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (the network layer). Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable one or more network hops away (e.g. across layer 3 boundaries from routers)." + "definition": "A vulnerability exploitable with network access means the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (the network layer). Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable one or more network hops away (e.g. across layer 3 boundaries from routers)." } ] } diff --git a/data/json/decision_points/cvss/attack_vector_3_0_1.json b/data/json/decision_points/cvss/attack_vector_3_0_1.json index fe2baea6..494691ea 100644 --- a/data/json/decision_points/cvss/attack_vector_3_0_1.json +++ b/data/json/decision_points/cvss/attack_vector_3_0_1.json @@ -1,30 +1,30 @@ { - "name": "Attack Vector", - "description": "This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.", "namespace": "cvss", - "version": "3.0.1", - "schemaVersion": "1-0-1", "key": "AV", + "version": "3.0.1", + "name": "Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.", + "schemaVersion": "2.0.0", "values": [ { "key": "P", "name": "Physical", - "description": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." + "definition": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." }, { "key": "L", "name": "Local", - "description": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." + "definition": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." }, { "key": "A", "name": "Adjacent", - "description": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." + "definition": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." }, { "key": "N", "name": "Network", - "description": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." + "definition": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." } ] } diff --git a/data/json/decision_points/cvss/authentication_1_0_0.json b/data/json/decision_points/cvss/authentication_1_0_0.json index a2bedd42..46bb9637 100644 --- a/data/json/decision_points/cvss/authentication_1_0_0.json +++ b/data/json/decision_points/cvss/authentication_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "Authentication", - "description": "This metric measures whether or not an attacker needs to be authenticated to the target system in order to exploit the vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "Au", + "version": "1.0.0", + "name": "Authentication", + "definition": "This metric measures whether or not an attacker needs to be authenticated to the target system in order to exploit the vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "Not Required", - "description": "Authentication is not required to access or exploit the vulnerability." + "definition": "Authentication is not required to access or exploit the vulnerability." }, { "key": "R", "name": "Required", - "description": "Authentication is required to access and exploit the vulnerability." + "definition": "Authentication is required to access and exploit the vulnerability." } ] } diff --git a/data/json/decision_points/cvss/authentication_2_0_0.json b/data/json/decision_points/cvss/authentication_2_0_0.json index f618747f..e3422570 100644 --- a/data/json/decision_points/cvss/authentication_2_0_0.json +++ b/data/json/decision_points/cvss/authentication_2_0_0.json @@ -1,25 +1,25 @@ { - "name": "Authentication", - "description": "This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The possible values for this metric are listed in Table 3. The fewer authentication instances that are required, the higher the vulnerability score.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "Au", + "version": "2.0.0", + "name": "Authentication", + "definition": "This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The possible values for this metric are listed in Table 3. The fewer authentication instances that are required, the higher the vulnerability score.", + "schemaVersion": "2.0.0", "values": [ { "key": "M", "name": "Multiple", - "description": "Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time." + "definition": "Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time." }, { "key": "S", "name": "Single", - "description": "The vulnerability requires an attacker to be logged into the system (such as at a command line or via a desktop session or web interface)." + "definition": "The vulnerability requires an attacker to be logged into the system (such as at a command line or via a desktop session or web interface)." }, { "key": "N", "name": "None", - "description": "Authentication is not required to exploit the vulnerability." + "definition": "Authentication is not required to exploit the vulnerability." } ] } diff --git a/data/json/decision_points/cvss/automatable_1_0_0.json b/data/json/decision_points/cvss/automatable_1_0_0.json index 03956092..0e7464bf 100644 --- a/data/json/decision_points/cvss/automatable_1_0_0.json +++ b/data/json/decision_points/cvss/automatable_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Automatable", - "description": "The \"Automatable\" metric captures the answer to the question \"Can an attacker automate exploitation events for this vulnerability across multiple targets?\" based on steps 1-4 of the kill chain.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "AU", + "version": "1.0.0", + "name": "Automatable", + "definition": "The \"Automatable\" metric captures the answer to the question \"Can an attacker automate exploitation events for this vulnerability across multiple targets?\" based on steps 1-4 of the kill chain.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "No", - "description": "Attackers cannot reliably automate all 4 steps of the kill chain for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation." + "definition": "Attackers cannot reliably automate all 4 steps of the kill chain for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation." }, { "key": "Y", "name": "Yes", - "description": "Attackers can reliably automate all 4 steps of the kill chain. These steps are reconnaissance, weaponization, delivery, and exploitation (e.g., the vulnerability is \"wormable\")." + "definition": "Attackers can reliably automate all 4 steps of the kill chain. These steps are reconnaissance, weaponization, delivery, and exploitation (e.g., the vulnerability is \"wormable\")." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/availability_impact_1_0_0.json b/data/json/decision_points/cvss/availability_impact_1_0_0.json index ad667d01..5a98cf85 100644 --- a/data/json/decision_points/cvss/availability_impact_1_0_0.json +++ b/data/json/decision_points/cvss/availability_impact_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Availability Impact", - "description": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the target system.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "A", + "version": "1.0.0", + "name": "Availability Impact", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the target system.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "No impact on availability." + "definition": "No impact on availability." }, { "key": "P", "name": "Partial", - "description": "Considerable lag in or interruptions in resource availability. For example, a network-based flood attack that reduces available bandwidth to a web server farm to such an extent that only a small number of connections successfully complete." + "definition": "Considerable lag in or interruptions in resource availability. For example, a network-based flood attack that reduces available bandwidth to a web server farm to such an extent that only a small number of connections successfully complete." }, { "key": "C", "name": "Complete", - "description": "Total shutdown of the affected resource. The attacker can render the resource completely unavailable." + "definition": "Total shutdown of the affected resource. The attacker can render the resource completely unavailable." } ] } diff --git a/data/json/decision_points/cvss/availability_impact_2_0_0.json b/data/json/decision_points/cvss/availability_impact_2_0_0.json index 7fd162ed..80a86a13 100644 --- a/data/json/decision_points/cvss/availability_impact_2_0_0.json +++ b/data/json/decision_points/cvss/availability_impact_2_0_0.json @@ -1,25 +1,25 @@ { - "name": "Availability Impact", - "description": "This metric measures the impact to availability of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "A", + "version": "2.0.0", + "name": "Availability Impact", + "definition": "This metric measures the impact to availability of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no impact to the availability of the system." + "definition": "There is no impact to the availability of the system." }, { "key": "L", "name": "Low", - "description": "There is reduced performance or interruptions in resource availability." + "definition": "There is reduced performance or interruptions in resource availability." }, { "key": "H", "name": "High", - "description": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." } ] } diff --git a/data/json/decision_points/cvss/availability_impact_2_0_1.json b/data/json/decision_points/cvss/availability_impact_2_0_1.json deleted file mode 100644 index e815d46a..00000000 --- a/data/json/decision_points/cvss/availability_impact_2_0_1.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "namespace": "cvss", - "version": "2.0.1", - "schemaVersion": "1-0-1", - "key": "A", - "name": "Availability Impact", - "description": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no impact to availability within the Vulnerable System." - }, - { - "key": "L", - "name": "Low", - "description": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." - }, - { - "key": "H", - "name": "High", - "description": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." - } - ] -} diff --git a/data/json/decision_points/cvss/availability_impact_to_the_subsequent_system_1_0_0.json b/data/json/decision_points/cvss/availability_impact_to_the_subsequent_system_1_0_0.json index 79369891..e6d67244 100644 --- a/data/json/decision_points/cvss/availability_impact_to_the_subsequent_system_1_0_0.json +++ b/data/json/decision_points/cvss/availability_impact_to_the_subsequent_system_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Availability Impact to the Subsequent System", - "description": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "SA", + "version": "1.0.0", + "name": "Availability Impact to the Subsequent System", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + "definition": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." }, { "key": "H", "name": "High", - "description": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." } ] } diff --git a/data/json/decision_points/cvss/availability_impact_to_the_vulnerable_system_3_0_0.json b/data/json/decision_points/cvss/availability_impact_to_the_vulnerable_system_3_0_0.json index 4e999e21..cd3f640f 100644 --- a/data/json/decision_points/cvss/availability_impact_to_the_vulnerable_system_3_0_0.json +++ b/data/json/decision_points/cvss/availability_impact_to_the_vulnerable_system_3_0_0.json @@ -1,25 +1,25 @@ { - "name": "Availability Impact to the Vulnerable System", - "description": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "VA", + "version": "3.0.0", + "name": "Availability Impact to the Vulnerable System", + "definition": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no impact to availability within the Vulnerable System." + "definition": "There is no impact to availability within the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." }, { "key": "H", "name": "High", - "description": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." } ] } diff --git a/data/json/decision_points/cvss/availability_requirement_1_0_0.json b/data/json/decision_points/cvss/availability_requirement_1_0_0.json index 01bd1da6..2a953169 100644 --- a/data/json/decision_points/cvss/availability_requirement_1_0_0.json +++ b/data/json/decision_points/cvss/availability_requirement_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Availability Requirement", - "description": "This metric measures the impact to the availability of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "AR", + "version": "1.0.0", + "name": "Availability Requirement", + "definition": "This metric measures the impact to the availability of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "ND", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/availability_requirement_1_1_0.json b/data/json/decision_points/cvss/availability_requirement_1_1_0.json index 28045aa0..17621b17 100644 --- a/data/json/decision_points/cvss/availability_requirement_1_1_0.json +++ b/data/json/decision_points/cvss/availability_requirement_1_1_0.json @@ -1,30 +1,30 @@ { - "name": "Availability Requirement", - "description": "This metric measures the impact to the availability of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "1.1.0", - "schemaVersion": "1-0-1", "key": "AR", + "version": "1.1.0", + "name": "Availability Requirement", + "definition": "This metric measures the impact to the availability of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/availability_requirement_1_1_1.json b/data/json/decision_points/cvss/availability_requirement_1_1_1.json index cb041336..8836d40c 100644 --- a/data/json/decision_points/cvss/availability_requirement_1_1_1.json +++ b/data/json/decision_points/cvss/availability_requirement_1_1_1.json @@ -1,30 +1,30 @@ { - "name": "Availability Requirement", - "description": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Availability.", "namespace": "cvss", - "version": "1.1.1", - "schemaVersion": "1-0-1", "key": "AR", + "version": "1.1.1", + "name": "Availability Requirement", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Availability.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/availability_requirement_without_not_defined__1_1_1.json b/data/json/decision_points/cvss/availability_requirement_without_not_defined__1_1_1.json new file mode 100644 index 00000000..230831d3 --- /dev/null +++ b/data/json/decision_points/cvss/availability_requirement_without_not_defined__1_1_1.json @@ -0,0 +1,25 @@ +{ + "namespace": "cvss", + "key": "AR_NoX", + "version": "1.1.1", + "name": "Availability Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Availability. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] +} diff --git a/data/json/decision_points/cvss/collateral_damage_potential_1_0_0.json b/data/json/decision_points/cvss/collateral_damage_potential_1_0_0.json index 19666f0f..fb14a84a 100644 --- a/data/json/decision_points/cvss/collateral_damage_potential_1_0_0.json +++ b/data/json/decision_points/cvss/collateral_damage_potential_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Collateral Damage Potential", - "description": "This metric measures the potential for a loss in physical equipment, property damage or loss of life or limb.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "CDP", + "version": "1.0.0", + "name": "Collateral Damage Potential", + "definition": "This metric measures the potential for a loss in physical equipment, property damage or loss of life or limb.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no potential for physical or property damage." + "definition": "There is no potential for physical or property damage." }, { "key": "L", "name": "Low", - "description": "A successful exploit of this vulnerability may result in light physical or property damage or loss. The system itself may be damaged or destroyed." + "definition": "A successful exploit of this vulnerability may result in light physical or property damage or loss. The system itself may be damaged or destroyed." }, { "key": "M", "name": "Medium", - "description": "A successful exploit of this vulnerability may result in significant physical or property damage or loss." + "definition": "A successful exploit of this vulnerability may result in significant physical or property damage or loss." }, { "key": "H", "name": "High", - "description": "A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. The range of effect may be over a wide area." + "definition": "A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. The range of effect may be over a wide area." } ] } diff --git a/data/json/decision_points/cvss/collateral_damage_potential_2_0_0.json b/data/json/decision_points/cvss/collateral_damage_potential_2_0_0.json index 00206e66..0fcd9bab 100644 --- a/data/json/decision_points/cvss/collateral_damage_potential_2_0_0.json +++ b/data/json/decision_points/cvss/collateral_damage_potential_2_0_0.json @@ -1,35 +1,35 @@ { - "name": "Collateral Damage Potential", - "description": "This metric measures the potential for loss of life or physical assets.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "CDP", + "version": "2.0.0", + "name": "Collateral Damage Potential", + "definition": "This metric measures the potential for loss of life or physical assets.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no potential for loss of life, physical assets, productivity or revenue." + "definition": "There is no potential for loss of life, physical assets, productivity or revenue." }, { "key": "LM", "name": "Low-Medium", - "description": "A successful exploit of this vulnerability may result in moderate physical or property damage or loss." + "definition": "A successful exploit of this vulnerability may result in moderate physical or property damage or loss." }, { "key": "MH", "name": "Medium-High", - "description": "A successful exploit of this vulnerability may result in significant physical or property damage or loss." + "definition": "A successful exploit of this vulnerability may result in significant physical or property damage or loss." }, { "key": "H", "name": "High", - "description": "A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. The range of effect may be over a wide area." + "definition": "A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. The range of effect may be over a wide area." }, { "key": "ND", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/confidentiality_impact_1_0_0.json b/data/json/decision_points/cvss/confidentiality_impact_1_0_0.json index 8f9ad138..f4b17718 100644 --- a/data/json/decision_points/cvss/confidentiality_impact_1_0_0.json +++ b/data/json/decision_points/cvss/confidentiality_impact_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Confidentiality Impact", - "description": "This metric measures the impact on confidentiality of a successful exploit of the vulnerability on the target system.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "C", + "version": "1.0.0", + "name": "Confidentiality Impact", + "definition": "This metric measures the impact on confidentiality of a successful exploit of the vulnerability on the target system.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "No impact on confidentiality." + "definition": "No impact on confidentiality." }, { "key": "P", "name": "Partial", - "description": "There is considerable informational disclosure. Access to critical system files is possible. There is a loss of important information, but the attacker doesn't have control over what is obtainable or the scope of the loss is constrained." + "definition": "There is considerable informational disclosure. Access to critical system files is possible. There is a loss of important information, but the attacker doesn't have control over what is obtainable or the scope of the loss is constrained." }, { "key": "C", "name": "Complete", - "description": "A total compromise of critical system information. A complete loss of system protection resulting in all critical system files being revealed. The attacker has sovereign control to read all of the system's data (memory, files, etc)." + "definition": "A total compromise of critical system information. A complete loss of system protection resulting in all critical system files being revealed. The attacker has sovereign control to read all of the system's data (memory, files, etc)." } ] } diff --git a/data/json/decision_points/cvss/confidentiality_impact_2_0_0.json b/data/json/decision_points/cvss/confidentiality_impact_2_0_0.json index 6f8c6c64..1b92fd1f 100644 --- a/data/json/decision_points/cvss/confidentiality_impact_2_0_0.json +++ b/data/json/decision_points/cvss/confidentiality_impact_2_0_0.json @@ -1,25 +1,25 @@ { - "name": "Confidentiality Impact", - "description": "This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "C", + "version": "2.0.0", + "name": "Confidentiality Impact", + "definition": "This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no loss of confidentiality within the impacted component." + "definition": "There is no loss of confidentiality within the impacted component." }, { "key": "L", "name": "Low", - "description": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." }, { "key": "H", "name": "High", - "description": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." } ] } diff --git a/data/json/decision_points/cvss/confidentiality_impact_2_0_1.json b/data/json/decision_points/cvss/confidentiality_impact_2_0_1.json deleted file mode 100644 index 4c72a5d5..00000000 --- a/data/json/decision_points/cvss/confidentiality_impact_2_0_1.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "namespace": "cvss", - "version": "2.0.1", - "schemaVersion": "1-0-1", - "key": "C", - "name": "Confidentiality Impact", - "description": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no loss of confidentiality within the impacted component." - }, - { - "key": "L", - "name": "Low", - "description": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." - }, - { - "key": "H", - "name": "High", - "description": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." - } - ] -} diff --git a/data/json/decision_points/cvss/confidentiality_impact_to_the_subsequent_system_1_0_0.json b/data/json/decision_points/cvss/confidentiality_impact_to_the_subsequent_system_1_0_0.json index 1b2041aa..761697d1 100644 --- a/data/json/decision_points/cvss/confidentiality_impact_to_the_subsequent_system_1_0_0.json +++ b/data/json/decision_points/cvss/confidentiality_impact_to_the_subsequent_system_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Confidentiality Impact to the Subsequent System", - "description": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "SC", + "version": "1.0.0", + "name": "Confidentiality Impact to the Subsequent System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "Negligible", - "description": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + "definition": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." }, { "key": "H", "name": "High", - "description": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." } ] } diff --git a/data/json/decision_points/cvss/confidentiality_impact_to_the_vulnerable_system_3_0_0.json b/data/json/decision_points/cvss/confidentiality_impact_to_the_vulnerable_system_3_0_0.json index 6fc61ef9..fd33d6e6 100644 --- a/data/json/decision_points/cvss/confidentiality_impact_to_the_vulnerable_system_3_0_0.json +++ b/data/json/decision_points/cvss/confidentiality_impact_to_the_vulnerable_system_3_0_0.json @@ -1,25 +1,25 @@ { - "name": "Confidentiality Impact to the Vulnerable System", - "description": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "VC", + "version": "3.0.0", + "name": "Confidentiality Impact to the Vulnerable System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no loss of confidentiality within the impacted component." + "definition": "There is no loss of confidentiality within the impacted component." }, { "key": "L", "name": "Low", - "description": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." }, { "key": "H", "name": "High", - "description": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." } ] } diff --git a/data/json/decision_points/cvss/confidentiality_requirement_1_0_0.json b/data/json/decision_points/cvss/confidentiality_requirement_1_0_0.json index 04b9e92d..d635256e 100644 --- a/data/json/decision_points/cvss/confidentiality_requirement_1_0_0.json +++ b/data/json/decision_points/cvss/confidentiality_requirement_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Confidentiality Requirement", - "description": "This metric measures the impact to the confidentiality of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "CR", + "version": "1.0.0", + "name": "Confidentiality Requirement", + "definition": "This metric measures the impact to the confidentiality of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "ND", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/confidentiality_requirement_1_1_0.json b/data/json/decision_points/cvss/confidentiality_requirement_1_1_0.json index 87453bab..1c188c33 100644 --- a/data/json/decision_points/cvss/confidentiality_requirement_1_1_0.json +++ b/data/json/decision_points/cvss/confidentiality_requirement_1_1_0.json @@ -1,30 +1,30 @@ { - "name": "Confidentiality Requirement", - "description": "This metric measures the impact to the confidentiality of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "1.1.0", - "schemaVersion": "1-0-1", "key": "CR", + "version": "1.1.0", + "name": "Confidentiality Requirement", + "definition": "This metric measures the impact to the confidentiality of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/confidentiality_requirement_1_1_1.json b/data/json/decision_points/cvss/confidentiality_requirement_1_1_1.json index 1c71ed0d..1d99b7cd 100644 --- a/data/json/decision_points/cvss/confidentiality_requirement_1_1_1.json +++ b/data/json/decision_points/cvss/confidentiality_requirement_1_1_1.json @@ -1,30 +1,30 @@ { - "name": "Confidentiality Requirement", - "description": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality.", "namespace": "cvss", - "version": "1.1.1", - "schemaVersion": "1-0-1", "key": "CR", + "version": "1.1.1", + "name": "Confidentiality Requirement", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/confidentiality_requirement_without_not_defined__1_1_1.json b/data/json/decision_points/cvss/confidentiality_requirement_without_not_defined__1_1_1.json new file mode 100644 index 00000000..a9970c8b --- /dev/null +++ b/data/json/decision_points/cvss/confidentiality_requirement_without_not_defined__1_1_1.json @@ -0,0 +1,25 @@ +{ + "namespace": "cvss", + "key": "CR_NoX", + "version": "1.1.1", + "name": "Confidentiality Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] +} diff --git a/data/json/decision_points/cvss/cvss_qualitative_severity_rating_scale_1_0_0.json b/data/json/decision_points/cvss/cvss_qualitative_severity_rating_scale_1_0_0.json new file mode 100644 index 00000000..96efe88c --- /dev/null +++ b/data/json/decision_points/cvss/cvss_qualitative_severity_rating_scale_1_0_0.json @@ -0,0 +1,35 @@ +{ + "namespace": "cvss", + "key": "CVSS", + "version": "1.0.0", + "name": "CVSS Qualitative Severity Rating Scale", + "definition": "The CVSS Qualitative Severity Rating Scale group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "None (0.0)" + }, + { + "key": "L", + "name": "Low", + "definition": "Low (0.1-3.9)" + }, + { + "key": "M", + "name": "Medium", + "definition": "Medium (4.0-6.9)" + }, + { + "key": "H", + "name": "High", + "definition": "High (7.0-8.9)" + }, + { + "key": "C", + "name": "Critical", + "definition": "Critical (9.0-10.0)" + } + ] +} diff --git a/data/json/decision_points/cvss/equivalence_set_1_1_0_0.json b/data/json/decision_points/cvss/equivalence_set_1_1_0_0.json index e4563635..583fb814 100644 --- a/data/json/decision_points/cvss/equivalence_set_1_1_0_0.json +++ b/data/json/decision_points/cvss/equivalence_set_1_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Equivalence Set 1", - "description": "AV/PR/UI with 3 levels specified in Table 24", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "EQ1", + "version": "1.0.0", + "name": "Equivalence Set 1", + "definition": "AV/PR/UI with 3 levels specified in Table 24", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "2: AV:P or not(AV:N or PR:N or UI:N)" + "definition": "2: AV:P or not(AV:N or PR:N or UI:N)" }, { "key": "M", "name": "Medium", - "description": "1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P" + "definition": "1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P" }, { "key": "H", "name": "High", - "description": "0: AV:N and PR:N and UI:N" + "definition": "0: AV:N and PR:N and UI:N" } ] } diff --git a/data/json/decision_points/cvss/equivalence_set_2_1_0_0.json b/data/json/decision_points/cvss/equivalence_set_2_1_0_0.json index db8745ce..6d32a351 100644 --- a/data/json/decision_points/cvss/equivalence_set_2_1_0_0.json +++ b/data/json/decision_points/cvss/equivalence_set_2_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "Equivalence Set 2", - "description": "AC/AT with 2 levels specified in Table 25", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "EQ2", + "version": "1.0.0", + "name": "Equivalence Set 2", + "definition": "AC/AT with 2 levels specified in Table 25", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "1: not (AC:L and AT:N)" + "definition": "1: not (AC:L and AT:N)" }, { "key": "H", "name": "High", - "description": "0: AC:L and AT:N" + "definition": "0: AC:L and AT:N" } ] } diff --git a/data/json/decision_points/cvss/equivalence_set_3_1_0_0.json b/data/json/decision_points/cvss/equivalence_set_3_1_0_0.json index 4b1aaf2b..b79a1b35 100644 --- a/data/json/decision_points/cvss/equivalence_set_3_1_0_0.json +++ b/data/json/decision_points/cvss/equivalence_set_3_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Equivalence Set 3", - "description": "VC/VI/VA with 3 levels specified in Table 26", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "EQ3", + "version": "1.0.0", + "name": "Equivalence Set 3", + "definition": "VC/VI/VA with 3 levels specified in Table 26", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "2: not (VC:H or VI:H or VA:H)" + "definition": "2: not (VC:H or VI:H or VA:H)" }, { "key": "M", "name": "Medium", - "description": "1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)" + "definition": "1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)" }, { "key": "H", "name": "High", - "description": "0: VC:H and VI:H" + "definition": "0: VC:H and VI:H" } ] } diff --git a/data/json/decision_points/cvss/equivalence_set_4_1_0_0.json b/data/json/decision_points/cvss/equivalence_set_4_1_0_0.json index d732ec5b..bdf23b9c 100644 --- a/data/json/decision_points/cvss/equivalence_set_4_1_0_0.json +++ b/data/json/decision_points/cvss/equivalence_set_4_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Equivalence Set 4", - "description": "SC/SI/SA with 3 levels specified in Table 27", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "EQ4", + "version": "1.0.0", + "name": "Equivalence Set 4", + "definition": "SC/SI/SA with 3 levels specified in Table 27", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "2: not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)" + "definition": "2: not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)" }, { "key": "M", "name": "Medium", - "description": "1: not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)" + "definition": "1: not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)" }, { "key": "H", "name": "High", - "description": "0: MSI:S or MSA:S" + "definition": "0: MSI:S or MSA:S" } ] } diff --git a/data/json/decision_points/cvss/equivalence_set_5_1_0_0.json b/data/json/decision_points/cvss/equivalence_set_5_1_0_0.json index f79d20a7..cee5ce58 100644 --- a/data/json/decision_points/cvss/equivalence_set_5_1_0_0.json +++ b/data/json/decision_points/cvss/equivalence_set_5_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Equivalence Set 5", - "description": "E with 3 levels specified in Table 28", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "EQ5", + "version": "1.0.0", + "name": "Equivalence Set 5", + "definition": "E with 3 levels specified in Table 28", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "2: E:U" + "definition": "2: E:U" }, { "key": "M", "name": "Medium", - "description": "1: E:P" + "definition": "1: E:P" }, { "key": "H", "name": "High", - "description": "0: E:A" + "definition": "0: E:A" } ] } diff --git a/data/json/decision_points/cvss/equivalence_set_6_1_0_0.json b/data/json/decision_points/cvss/equivalence_set_6_1_0_0.json index 631acd7b..d2ef4775 100644 --- a/data/json/decision_points/cvss/equivalence_set_6_1_0_0.json +++ b/data/json/decision_points/cvss/equivalence_set_6_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "Equivalence Set 6", - "description": "VC/VI/VA+CR/CI/CA with 2 levels specified in Table 29", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "EQ6", + "version": "1.0.0", + "name": "Equivalence Set 6", + "definition": "VC/VI/VA+CR/CI/CA with 2 levels specified in Table 29", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "1: not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)" + "definition": "1: not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)" }, { "key": "H", "name": "High", - "description": "0: (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)" + "definition": "0: (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)" } ] } diff --git a/data/json/decision_points/cvss/exploit_code_maturity_1_2_0.json b/data/json/decision_points/cvss/exploit_code_maturity_1_2_0.json index a4e59e23..60d471cd 100644 --- a/data/json/decision_points/cvss/exploit_code_maturity_1_2_0.json +++ b/data/json/decision_points/cvss/exploit_code_maturity_1_2_0.json @@ -1,35 +1,35 @@ { - "name": "Exploit Code Maturity", - "description": "measures the likelihood of the vulnerability being attacked, and is typically based on the current state of exploit techniques, exploit code availability, or active, 'in-the-wild' exploitation", "namespace": "cvss", - "version": "1.2.0", - "schemaVersion": "1-0-1", "key": "E", + "version": "1.2.0", + "name": "Exploit Code Maturity", + "definition": "measures the likelihood of the vulnerability being attacked, and is typically based on the current state of exploit techniques, exploit code availability, or active, 'in-the-wild' exploitation", + "schemaVersion": "2.0.0", "values": [ { "key": "U", "name": "Unproven", - "description": "No exploit code is available, or an exploit is theoretical." + "definition": "No exploit code is available, or an exploit is theoretical." }, { "key": "POC", "name": "Proof-of-Concept", - "description": "Proof-of-concept exploit code is available, or an attack demonstration is not practical for most systems. The code or technique is not functional in all situations and may require substantial modification by a skilled attacker." + "definition": "Proof-of-concept exploit code is available, or an attack demonstration is not practical for most systems. The code or technique is not functional in all situations and may require substantial modification by a skilled attacker." }, { "key": "F", "name": "Functional", - "description": "Functional exploit code is available. The code works in most situations where the vulnerability exists." + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability exists." }, { "key": "H", "name": "High", - "description": "Functional autonomous code exists, or no exploit is required (manual trigger) and details are widely available. Exploit code works in every situation, or is actively being delivered via an autonomous agent (such as a worm or virus). Network-connected systems are likely to encounter scanning or exploitation attempts. Exploit development has reached the level of reliable, widely-available, easy-to-use automated tools." + "definition": "Functional autonomous code exists, or no exploit is required (manual trigger) and details are widely available. Exploit code works in every situation, or is actively being delivered via an autonomous agent (such as a worm or virus). Network-connected systems are likely to encounter scanning or exploitation attempts. Exploit development has reached the level of reliable, widely-available, easy-to-use automated tools." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/exploit_maturity_2_0_0.json b/data/json/decision_points/cvss/exploit_maturity_2_0_0.json index 28eeebd3..e12b3c98 100644 --- a/data/json/decision_points/cvss/exploit_maturity_2_0_0.json +++ b/data/json/decision_points/cvss/exploit_maturity_2_0_0.json @@ -1,30 +1,30 @@ { - "name": "Exploit Maturity", - "description": "This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "E", + "version": "2.0.0", + "name": "Exploit Maturity", + "definition": "This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation.", + "schemaVersion": "2.0.0", "values": [ { "key": "U", "name": "Unreported", - "description": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" + "definition": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" }, { "key": "P", "name": "Proof-of-Concept", - "description": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" + "definition": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" }, { "key": "A", "name": "Attacked", - "description": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" + "definition": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/exploit_maturity_without_not_defined__2_0_0.json b/data/json/decision_points/cvss/exploit_maturity_without_not_defined__2_0_0.json new file mode 100644 index 00000000..879ddc6b --- /dev/null +++ b/data/json/decision_points/cvss/exploit_maturity_without_not_defined__2_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "cvss", + "key": "E_NoX", + "version": "2.0.0", + "name": "Exploit Maturity (without Not Defined)", + "definition": "This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unreported", + "definition": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" + }, + { + "key": "P", + "name": "Proof-of-Concept", + "definition": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" + }, + { + "key": "A", + "name": "Attacked", + "definition": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" + } + ] +} diff --git a/data/json/decision_points/cvss/exploitability_1_0_0.json b/data/json/decision_points/cvss/exploitability_1_0_0.json index 707f297d..d94b8005 100644 --- a/data/json/decision_points/cvss/exploitability_1_0_0.json +++ b/data/json/decision_points/cvss/exploitability_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Exploitability", - "description": "This metric measures the current state of exploit technique or code availability and suggests a likelihood of exploitation.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "E", + "version": "1.0.0", + "name": "Exploitability", + "definition": "This metric measures the current state of exploit technique or code availability and suggests a likelihood of exploitation.", + "schemaVersion": "2.0.0", "values": [ { "key": "U", "name": "Unproven", - "description": "No exploit code is yet available or an exploit method is entirely theoretical." + "definition": "No exploit code is yet available or an exploit method is entirely theoretical." }, { "key": "P", "name": "Proof of Concept", - "description": "Proof of concept exploit code or an attack demonstration that is not practically applicable to deployed systems is available. The code or technique is not functional in all situations and may require substantial hand tuning by a skilled attacker for use against deployed systems." + "definition": "Proof of concept exploit code or an attack demonstration that is not practically applicable to deployed systems is available. The code or technique is not functional in all situations and may require substantial hand tuning by a skilled attacker for use against deployed systems." }, { "key": "F", "name": "Functional", - "description": "Functional exploit code is available. The code works in most situations where the vulnerability is exploitable." + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability is exploitable." }, { "key": "H", "name": "High", - "description": "Either the vulnerability is exploitable by functional mobile autonomous code or no exploit is required (manual trigger) and the details for the manual technique are widely available. The code works in every situation where the vulnerability is exploitable and/or is actively being delivered via a mobile autonomous agent (a worm or virus)." + "definition": "Either the vulnerability is exploitable by functional mobile autonomous code or no exploit is required (manual trigger) and the details for the manual technique are widely available. The code works in every situation where the vulnerability is exploitable and/or is actively being delivered via a mobile autonomous agent (a worm or virus)." } ] } diff --git a/data/json/decision_points/cvss/exploitability_1_1_0.json b/data/json/decision_points/cvss/exploitability_1_1_0.json index add3fd28..e62634cd 100644 --- a/data/json/decision_points/cvss/exploitability_1_1_0.json +++ b/data/json/decision_points/cvss/exploitability_1_1_0.json @@ -1,35 +1,35 @@ { - "name": "Exploitability", - "description": "This metric measures the current state of exploit technique or code availability and suggests a likelihood of exploitation.", "namespace": "cvss", - "version": "1.1.0", - "schemaVersion": "1-0-1", "key": "E", + "version": "1.1.0", + "name": "Exploitability", + "definition": "This metric measures the current state of exploit technique or code availability and suggests a likelihood of exploitation.", + "schemaVersion": "2.0.0", "values": [ { "key": "U", "name": "Unproven", - "description": "No exploit code is yet available or an exploit method is entirely theoretical." + "definition": "No exploit code is yet available or an exploit method is entirely theoretical." }, { "key": "P", "name": "Proof of Concept", - "description": "Proof of concept exploit code or an attack demonstration that is not practically applicable to deployed systems is available. The code or technique is not functional in all situations and may require substantial hand tuning by a skilled attacker for use against deployed systems." + "definition": "Proof of concept exploit code or an attack demonstration that is not practically applicable to deployed systems is available. The code or technique is not functional in all situations and may require substantial hand tuning by a skilled attacker for use against deployed systems." }, { "key": "F", "name": "Functional", - "description": "Functional exploit code is available. The code works in most situations where the vulnerability is exploitable." + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability is exploitable." }, { "key": "H", "name": "High", - "description": "Either the vulnerability is exploitable by functional mobile autonomous code or no exploit is required (manual trigger) and the details for the manual technique are widely available. The code works in every situation where the vulnerability is exploitable and/or is actively being delivered via a mobile autonomous agent (a worm or virus)." + "definition": "Either the vulnerability is exploitable by functional mobile autonomous code or no exploit is required (manual trigger) and the details for the manual technique are widely available. The code works in every situation where the vulnerability is exploitable and/or is actively being delivered via a mobile autonomous agent (a worm or virus)." }, { "key": "ND", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/impact_bias_1_0_0.json b/data/json/decision_points/cvss/impact_bias_1_0_0.json index fc7316eb..22cb190c 100644 --- a/data/json/decision_points/cvss/impact_bias_1_0_0.json +++ b/data/json/decision_points/cvss/impact_bias_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Impact Bias", - "description": "This metric measures the impact bias of the vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "IB", + "version": "1.0.0", + "name": "Impact Bias", + "definition": "This metric measures the impact bias of the vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "Normal", - "description": "Confidentiality Impact, Integrity Impact, and Availability Impact are all assigned the same weight." + "definition": "Confidentiality Impact, Integrity Impact, and Availability Impact are all assigned the same weight." }, { "key": "C", "name": "Confidentiality", - "description": "Confidentiality impact is assigned greater weight than Integrity Impact or Availability Impact." + "definition": "Confidentiality impact is assigned greater weight than Integrity Impact or Availability Impact." }, { "key": "I", "name": "Integrity", - "description": "Integrity Impact is assigned greater weight than Confidentiality Impact or Availability Impact." + "definition": "Integrity Impact is assigned greater weight than Confidentiality Impact or Availability Impact." }, { "key": "A", "name": "Availability", - "description": "Availability Impact is assigned greater weight than Confidentiality Impact or Integrity Impact." + "definition": "Availability Impact is assigned greater weight than Confidentiality Impact or Integrity Impact." } ] } diff --git a/data/json/decision_points/cvss/integrity_impact_1_0_0.json b/data/json/decision_points/cvss/integrity_impact_1_0_0.json index 5880fcf4..d2bd3620 100644 --- a/data/json/decision_points/cvss/integrity_impact_1_0_0.json +++ b/data/json/decision_points/cvss/integrity_impact_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Integrity Impact", - "description": "This metric measures the impact on integrity a successful exploit of the vulnerability will have on the target system.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "I", + "version": "1.0.0", + "name": "Integrity Impact", + "definition": "This metric measures the impact on integrity a successful exploit of the vulnerability will have on the target system.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "No impact on integrity." + "definition": "No impact on integrity." }, { "key": "P", "name": "Partial", - "description": "Considerable breach in integrity. Modification of critical system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is constrained. For example, key system or program files may be overwritten or modified, but at random or in a limited context or scope." + "definition": "Considerable breach in integrity. Modification of critical system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is constrained. For example, key system or program files may be overwritten or modified, but at random or in a limited context or scope." }, { "key": "C", "name": "Complete", - "description": "A total compromise of system integrity. There is a complete loss of system protection resulting in the entire system being compromised. The attacker has sovereign control to modify any system files." + "definition": "A total compromise of system integrity. There is a complete loss of system protection resulting in the entire system being compromised. The attacker has sovereign control to modify any system files." } ] } diff --git a/data/json/decision_points/cvss/integrity_impact_2_0_0.json b/data/json/decision_points/cvss/integrity_impact_2_0_0.json index ecb0fd66..66923efa 100644 --- a/data/json/decision_points/cvss/integrity_impact_2_0_0.json +++ b/data/json/decision_points/cvss/integrity_impact_2_0_0.json @@ -1,25 +1,25 @@ { - "name": "Integrity Impact", - "description": "This metric measures the impact to integrity of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "I", + "version": "2.0.0", + "name": "Integrity Impact", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no impact to the integrity of the system." + "definition": "There is no impact to the integrity of the system." }, { "key": "L", "name": "Low", - "description": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. The data modification does not have a direct, serious impact on the impacted component." + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. The data modification does not have a direct, serious impact on the impacted component." }, { "key": "H", "name": "High", - "description": "There is a total loss of integrity, or a complete loss of protection." + "definition": "There is a total loss of integrity, or a complete loss of protection." } ] } diff --git a/data/json/decision_points/cvss/integrity_impact_2_0_1.json b/data/json/decision_points/cvss/integrity_impact_2_0_1.json deleted file mode 100644 index 59579fbd..00000000 --- a/data/json/decision_points/cvss/integrity_impact_2_0_1.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "namespace": "cvss", - "version": "2.0.1", - "schemaVersion": "1-0-1", - "key": "I", - "name": "Integrity Impact", - "description": "This metric measures the impact to integrity of a successfully exploited vulnerability.", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no loss of integrity within the Vulnerable System." - }, - { - "key": "L", - "name": "Low", - "description": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." - }, - { - "key": "H", - "name": "High", - "description": "There is a total loss of integrity, or a complete loss of protection." - } - ] -} diff --git a/data/json/decision_points/cvss/integrity_impact_to_the_subsequent_system_1_0_0.json b/data/json/decision_points/cvss/integrity_impact_to_the_subsequent_system_1_0_0.json index 80c99790..b65690ba 100644 --- a/data/json/decision_points/cvss/integrity_impact_to_the_subsequent_system_1_0_0.json +++ b/data/json/decision_points/cvss/integrity_impact_to_the_subsequent_system_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Integrity Impact to the Subsequent System", - "description": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "SI", + "version": "1.0.0", + "name": "Integrity Impact to the Subsequent System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + "definition": "There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." }, { "key": "H", "name": "High", - "description": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." } ] } diff --git a/data/json/decision_points/cvss/integrity_impact_to_the_vulnerable_system_3_0_0.json b/data/json/decision_points/cvss/integrity_impact_to_the_vulnerable_system_3_0_0.json index 745ee9e1..c8d16851 100644 --- a/data/json/decision_points/cvss/integrity_impact_to_the_vulnerable_system_3_0_0.json +++ b/data/json/decision_points/cvss/integrity_impact_to_the_vulnerable_system_3_0_0.json @@ -1,25 +1,25 @@ { - "name": "Integrity Impact to the Vulnerable System", - "description": "This metric measures the impact to integrity of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "VI", + "version": "3.0.0", + "name": "Integrity Impact to the Vulnerable System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no loss of integrity within the Vulnerable System." + "definition": "There is no loss of integrity within the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." }, { "key": "H", "name": "High", - "description": "There is a total loss of integrity, or a complete loss of protection." + "definition": "There is a total loss of integrity, or a complete loss of protection." } ] } diff --git a/data/json/decision_points/cvss/integrity_requirement_1_0_0.json b/data/json/decision_points/cvss/integrity_requirement_1_0_0.json index f49d6438..903e6cd4 100644 --- a/data/json/decision_points/cvss/integrity_requirement_1_0_0.json +++ b/data/json/decision_points/cvss/integrity_requirement_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Integrity Requirement", - "description": "This metric measures the impact to the integrity of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "IR", + "version": "1.0.0", + "name": "Integrity Requirement", + "definition": "This metric measures the impact to the integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "ND", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/integrity_requirement_1_0_1.json b/data/json/decision_points/cvss/integrity_requirement_1_0_1.json deleted file mode 100644 index 4c8e1762..00000000 --- a/data/json/decision_points/cvss/integrity_requirement_1_0_1.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "namespace": "cvss", - "version": "1.0.1", - "schemaVersion": "1-0-1", - "key": "IR", - "name": "Integrity Requirement", - "description": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality.", - "values": [ - { - "key": "L", - "name": "Low", - "description": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." - }, - { - "key": "M", - "name": "Medium", - "description": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." - }, - { - "key": "H", - "name": "High", - "description": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." - }, - { - "key": "X", - "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." - } - ] -} diff --git a/data/json/decision_points/cvss/integrity_requirement_1_1_0.json b/data/json/decision_points/cvss/integrity_requirement_1_1_0.json index 7378845f..80096996 100644 --- a/data/json/decision_points/cvss/integrity_requirement_1_1_0.json +++ b/data/json/decision_points/cvss/integrity_requirement_1_1_0.json @@ -1,30 +1,30 @@ { - "name": "Integrity Requirement", - "description": "This metric measures the impact to the integrity of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "1.1.0", - "schemaVersion": "1-0-1", "key": "IR", + "version": "1.1.0", + "name": "Integrity Requirement", + "definition": "This metric measures the impact to the integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/integrity_requirement_1_1_1.json b/data/json/decision_points/cvss/integrity_requirement_1_1_1.json index 05fd2858..95400381 100644 --- a/data/json/decision_points/cvss/integrity_requirement_1_1_1.json +++ b/data/json/decision_points/cvss/integrity_requirement_1_1_1.json @@ -1,30 +1,30 @@ { - "name": "Integrity Requirement", - "description": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality.", "namespace": "cvss", - "version": "1.1.1", - "schemaVersion": "1-0-1", "key": "IR", + "version": "1.1.1", + "name": "Integrity Requirement", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality.", + "schemaVersion": "2.0.0", "values": [ { "key": "L", "name": "Low", - "description": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "M", "name": "Medium", - "description": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "H", "name": "High", - "description": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/integrity_requirement_without_not_defined__1_1_1.json b/data/json/decision_points/cvss/integrity_requirement_without_not_defined__1_1_1.json new file mode 100644 index 00000000..3abf6819 --- /dev/null +++ b/data/json/decision_points/cvss/integrity_requirement_without_not_defined__1_1_1.json @@ -0,0 +1,25 @@ +{ + "namespace": "cvss", + "key": "IR_NoX", + "version": "1.1.1", + "name": "Integrity Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] +} diff --git a/data/json/decision_points/cvss/modified_attack_complexity_3_0_0.json b/data/json/decision_points/cvss/modified_attack_complexity_3_0_0.json index 6e8df236..fb5b8d39 100644 --- a/data/json/decision_points/cvss/modified_attack_complexity_3_0_0.json +++ b/data/json/decision_points/cvss/modified_attack_complexity_3_0_0.json @@ -1,25 +1,25 @@ { - "name": "Modified Attack Complexity", - "description": "This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "MAC", + "version": "3.0.0", + "name": "Modified Attack Complexity", + "definition": "This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.", + "schemaVersion": "2.0.0", "values": [ - { - "key": "L", - "name": "Low", - "description": "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component." - }, { "key": "H", "name": "High", - "description": "A successful attack depends on conditions beyond the attacker's control." + "definition": "A successful attack depends on conditions beyond the attacker's control." + }, + { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_attack_complexity_3_0_1.json b/data/json/decision_points/cvss/modified_attack_complexity_3_0_1.json index a8bee010..dc7a0f6b 100644 --- a/data/json/decision_points/cvss/modified_attack_complexity_3_0_1.json +++ b/data/json/decision_points/cvss/modified_attack_complexity_3_0_1.json @@ -1,25 +1,25 @@ { - "name": "Modified Attack Complexity", - "description": "This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. ", "namespace": "cvss", - "version": "3.0.1", - "schemaVersion": "1-0-1", "key": "MAC", + "version": "3.0.1", + "name": "Modified Attack Complexity", + "definition": "This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. ", + "schemaVersion": "2.0.0", "values": [ - { - "key": "L", - "name": "Low", - "description": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " - }, { "key": "H", "name": "High", - "description": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + "definition": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_attack_requirements_1_0_0.json b/data/json/decision_points/cvss/modified_attack_requirements_1_0_0.json index 4f446155..8b650401 100644 --- a/data/json/decision_points/cvss/modified_attack_requirements_1_0_0.json +++ b/data/json/decision_points/cvss/modified_attack_requirements_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Modified Attack Requirements", - "description": "This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "MAT", + "version": "1.0.0", + "name": "Modified Attack Requirements", + "definition": "This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.", + "schemaVersion": "2.0.0", "values": [ - { - "key": "N", - "name": "None", - "description": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." - }, { "key": "P", "name": "Present", - "description": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + "definition": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + }, + { + "key": "N", + "name": "None", + "definition": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_attack_vector_3_0_0.json b/data/json/decision_points/cvss/modified_attack_vector_3_0_0.json index cd8261e7..85e7dc16 100644 --- a/data/json/decision_points/cvss/modified_attack_vector_3_0_0.json +++ b/data/json/decision_points/cvss/modified_attack_vector_3_0_0.json @@ -1,35 +1,35 @@ { - "name": "Modified Attack Vector", - "description": "This metric reflects the context by which vulnerability exploitation is possible. ", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "MAV", + "version": "3.0.0", + "name": "Modified Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. ", + "schemaVersion": "2.0.0", "values": [ { "key": "P", "name": "Physical", - "description": "A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent." + "definition": "A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent." }, { "key": "L", "name": "Local", - "description": "A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file." + "definition": "A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file." }, { "key": "A", "name": "Adjacent", - "description": "A vulnerability exploitable with adjacent network access means the vulnerable component is bound to the network stack, however the attack is limited to the same shared physical (e.g. Bluetooth, IEEE 802.11), or logical (e.g. local IP subnet) network, and cannot be performed across an OSI layer 3 boundary (e.g. a router)." + "definition": "A vulnerability exploitable with adjacent network access means the vulnerable component is bound to the network stack, however the attack is limited to the same shared physical (e.g. Bluetooth, IEEE 802.11), or logical (e.g. local IP subnet) network, and cannot be performed across an OSI layer 3 boundary (e.g. a router)." }, { "key": "N", "name": "Network", - "description": "A vulnerability exploitable with network access means the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (the network layer). Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable one or more network hops away (e.g. across layer 3 boundaries from routers)." + "definition": "A vulnerability exploitable with network access means the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (the network layer). Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable one or more network hops away (e.g. across layer 3 boundaries from routers)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_attack_vector_3_0_1.json b/data/json/decision_points/cvss/modified_attack_vector_3_0_1.json index 35995809..88c8d267 100644 --- a/data/json/decision_points/cvss/modified_attack_vector_3_0_1.json +++ b/data/json/decision_points/cvss/modified_attack_vector_3_0_1.json @@ -1,35 +1,35 @@ { - "name": "Modified Attack Vector", - "description": "This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.", "namespace": "cvss", - "version": "3.0.1", - "schemaVersion": "1-0-1", "key": "MAV", + "version": "3.0.1", + "name": "Modified Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.", + "schemaVersion": "2.0.0", "values": [ { "key": "P", "name": "Physical", - "description": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." + "definition": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." }, { "key": "L", "name": "Local", - "description": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." + "definition": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." }, { "key": "A", "name": "Adjacent", - "description": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." + "definition": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." }, { "key": "N", "name": "Network", - "description": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." + "definition": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_availability_impact_2_0_0.json b/data/json/decision_points/cvss/modified_availability_impact_2_0_0.json index efea9be1..c5aa2298 100644 --- a/data/json/decision_points/cvss/modified_availability_impact_2_0_0.json +++ b/data/json/decision_points/cvss/modified_availability_impact_2_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Availability Impact", - "description": "This metric measures the impact to availability of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "MA", + "version": "2.0.0", + "name": "Modified Availability Impact", + "definition": "This metric measures the impact to availability of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no impact to the availability of the system." + "definition": "There is no impact to the availability of the system." }, { "key": "L", "name": "Low", - "description": "There is reduced performance or interruptions in resource availability." + "definition": "There is reduced performance or interruptions in resource availability." }, { "key": "H", "name": "High", - "description": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_availability_impact_2_0_1.json b/data/json/decision_points/cvss/modified_availability_impact_2_0_1.json deleted file mode 100644 index 793c5579..00000000 --- a/data/json/decision_points/cvss/modified_availability_impact_2_0_1.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "namespace": "cvss", - "version": "2.0.1", - "schemaVersion": "1-0-1", - "key": "MA", - "name": "Modified Availability Impact", - "description": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no impact to availability within the Vulnerable System." - }, - { - "key": "L", - "name": "Low", - "description": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." - }, - { - "key": "H", - "name": "High", - "description": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." - }, - { - "key": "X", - "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." - } - ] -} diff --git a/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_0.json b/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_0.json index 786f0390..101ad830 100644 --- a/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_0.json +++ b/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Availability Impact to the Subsequent System", - "description": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "MSA", + "version": "1.0.0", + "name": "Modified Availability Impact to the Subsequent System", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", - "name": "Negligible", - "description": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + "name": "None", + "definition": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." }, { "key": "H", "name": "High", - "description": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_1.json b/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_1.json new file mode 100644 index 00000000..c22b366c --- /dev/null +++ b/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_1.json @@ -0,0 +1,35 @@ +{ + "namespace": "cvss", + "key": "MSA", + "version": "1.0.1", + "name": "Modified Availability Impact to the Subsequent System", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] +} diff --git a/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_without_not_defined__1_0_1.json b/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_without_not_defined__1_0_1.json new file mode 100644 index 00000000..ae06a2ae --- /dev/null +++ b/data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_without_not_defined__1_0_1.json @@ -0,0 +1,30 @@ +{ + "namespace": "cvss", + "key": "MSA_NoX", + "version": "1.0.1", + "name": "Modified Availability Impact to the Subsequent System (without Not Defined)", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] +} diff --git a/data/json/decision_points/cvss/modified_availability_impact_to_the_vulnerable_system_3_0_0.json b/data/json/decision_points/cvss/modified_availability_impact_to_the_vulnerable_system_3_0_0.json index 689120d5..5f0feecb 100644 --- a/data/json/decision_points/cvss/modified_availability_impact_to_the_vulnerable_system_3_0_0.json +++ b/data/json/decision_points/cvss/modified_availability_impact_to_the_vulnerable_system_3_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Availability Impact to the Vulnerable System", - "description": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "MVA", + "version": "3.0.0", + "name": "Modified Availability Impact to the Vulnerable System", + "definition": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no impact to availability within the Vulnerable System." + "definition": "There is no impact to availability within the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." }, { "key": "H", "name": "High", - "description": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_confidentiality_impact_2_0_0.json b/data/json/decision_points/cvss/modified_confidentiality_impact_2_0_0.json index ef523bac..ddf0beba 100644 --- a/data/json/decision_points/cvss/modified_confidentiality_impact_2_0_0.json +++ b/data/json/decision_points/cvss/modified_confidentiality_impact_2_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Confidentiality Impact", - "description": "This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "MC", + "version": "2.0.0", + "name": "Modified Confidentiality Impact", + "definition": "This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no loss of confidentiality within the impacted component." + "definition": "There is no loss of confidentiality within the impacted component." }, { "key": "L", "name": "Low", - "description": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." }, { "key": "H", "name": "High", - "description": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_confidentiality_impact_2_0_1.json b/data/json/decision_points/cvss/modified_confidentiality_impact_2_0_1.json deleted file mode 100644 index 027f96a0..00000000 --- a/data/json/decision_points/cvss/modified_confidentiality_impact_2_0_1.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "namespace": "cvss", - "version": "2.0.1", - "schemaVersion": "1-0-1", - "key": "MC", - "name": "Modified Confidentiality Impact", - "description": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no loss of confidentiality within the impacted component." - }, - { - "key": "L", - "name": "Low", - "description": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." - }, - { - "key": "H", - "name": "High", - "description": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." - }, - { - "key": "X", - "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." - } - ] -} diff --git a/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_0.json b/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_0.json index ea677a2a..e201564b 100644 --- a/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_0.json +++ b/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Confidentiality Impact to the Subsequent System", - "description": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "MSC", + "version": "1.0.0", + "name": "Modified Confidentiality Impact to the Subsequent System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "Negligible", - "description": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + "definition": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." }, { "key": "H", "name": "High", - "description": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_1.json b/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_1.json new file mode 100644 index 00000000..31fa1d8d --- /dev/null +++ b/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_1.json @@ -0,0 +1,30 @@ +{ + "namespace": "cvss", + "key": "MSC", + "version": "1.0.1", + "name": "Modified Confidentiality Impact to the Subsequent System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] +} diff --git a/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_vulnerable_system_3_0_0.json b/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_vulnerable_system_3_0_0.json index b3f09692..425d4f03 100644 --- a/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_vulnerable_system_3_0_0.json +++ b/data/json/decision_points/cvss/modified_confidentiality_impact_to_the_vulnerable_system_3_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Confidentiality Impact to the Vulnerable System", - "description": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "MVC", + "version": "3.0.0", + "name": "Modified Confidentiality Impact to the Vulnerable System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no loss of confidentiality within the impacted component." + "definition": "There is no loss of confidentiality within the impacted component." }, { "key": "L", "name": "Low", - "description": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." }, { "key": "H", "name": "High", - "description": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_integrity_impact_2_0_0.json b/data/json/decision_points/cvss/modified_integrity_impact_2_0_0.json index 0e010de0..fbf2eeae 100644 --- a/data/json/decision_points/cvss/modified_integrity_impact_2_0_0.json +++ b/data/json/decision_points/cvss/modified_integrity_impact_2_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Integrity Impact", - "description": "This metric measures the impact to integrity of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "MI", + "version": "2.0.0", + "name": "Modified Integrity Impact", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no impact to the integrity of the system." + "definition": "There is no impact to the integrity of the system." }, { "key": "L", "name": "Low", - "description": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. The data modification does not have a direct, serious impact on the impacted component." + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. The data modification does not have a direct, serious impact on the impacted component." }, { "key": "H", "name": "High", - "description": "There is a total loss of integrity, or a complete loss of protection." + "definition": "There is a total loss of integrity, or a complete loss of protection." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_integrity_impact_2_0_1.json b/data/json/decision_points/cvss/modified_integrity_impact_2_0_1.json deleted file mode 100644 index a02b0fe3..00000000 --- a/data/json/decision_points/cvss/modified_integrity_impact_2_0_1.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "namespace": "cvss", - "version": "2.0.1", - "schemaVersion": "1-0-1", - "key": "MI", - "name": "Modified Integrity Impact", - "description": "This metric measures the impact to integrity of a successfully exploited vulnerability.", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no loss of integrity within the Vulnerable System." - }, - { - "key": "L", - "name": "Low", - "description": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." - }, - { - "key": "H", - "name": "High", - "description": "There is a total loss of integrity, or a complete loss of protection." - }, - { - "key": "X", - "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." - } - ] -} diff --git a/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_0.json b/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_0.json index 719e36b4..754befa2 100644 --- a/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_0.json +++ b/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_0.json @@ -1,35 +1,30 @@ { - "name": "Modified Integrity Impact to the Subsequent System", - "description": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "MSI", + "version": "1.0.0", + "name": "Modified Integrity Impact to the Subsequent System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", - "name": "Negligible", - "description": "There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + "name": "None", + "definition": "There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." }, { "key": "H", "name": "High", - "description": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." - }, - { - "key": "S", - "name": "Safety", - "description": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_1.json b/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_1.json new file mode 100644 index 00000000..a116751d --- /dev/null +++ b/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_1.json @@ -0,0 +1,35 @@ +{ + "namespace": "cvss", + "key": "MSI", + "version": "1.0.1", + "name": "Modified Integrity Impact to the Subsequent System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] +} diff --git a/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_without_not_defined__1_0_1.json b/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_without_not_defined__1_0_1.json new file mode 100644 index 00000000..92495703 --- /dev/null +++ b/data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_without_not_defined__1_0_1.json @@ -0,0 +1,30 @@ +{ + "namespace": "cvss", + "key": "MSI_NoX", + "version": "1.0.1", + "name": "Modified Integrity Impact to the Subsequent System (without Not Defined)", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] +} diff --git a/data/json/decision_points/cvss/modified_integrity_impact_to_the_vulnerable_system_3_0_0.json b/data/json/decision_points/cvss/modified_integrity_impact_to_the_vulnerable_system_3_0_0.json index 76f318a2..7964a614 100644 --- a/data/json/decision_points/cvss/modified_integrity_impact_to_the_vulnerable_system_3_0_0.json +++ b/data/json/decision_points/cvss/modified_integrity_impact_to_the_vulnerable_system_3_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Integrity Impact to the Vulnerable System", - "description": "This metric measures the impact to integrity of a successfully exploited vulnerability.", "namespace": "cvss", - "version": "3.0.0", - "schemaVersion": "1-0-1", "key": "MVI", + "version": "3.0.0", + "name": "Modified Integrity Impact to the Vulnerable System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "There is no loss of integrity within the Vulnerable System." + "definition": "There is no loss of integrity within the Vulnerable System." }, { "key": "L", "name": "Low", - "description": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." }, { "key": "H", "name": "High", - "description": "There is a total loss of integrity, or a complete loss of protection." + "definition": "There is a total loss of integrity, or a complete loss of protection." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_privileges_required_1_0_0.json b/data/json/decision_points/cvss/modified_privileges_required_1_0_0.json index 4aa2e7fe..a88ee9f5 100644 --- a/data/json/decision_points/cvss/modified_privileges_required_1_0_0.json +++ b/data/json/decision_points/cvss/modified_privileges_required_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified Privileges Required", - "description": "This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "MPR", + "version": "1.0.0", + "name": "Modified Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "H", "name": "High", - "description": "The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files." + "definition": "The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files." }, { "key": "L", "name": "Low", - "description": "The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources." + "definition": "The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources." }, { "key": "N", "name": "None", - "description": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_privileges_required_1_0_1.json b/data/json/decision_points/cvss/modified_privileges_required_1_0_1.json index 9edb12a4..0e4a54c8 100644 --- a/data/json/decision_points/cvss/modified_privileges_required_1_0_1.json +++ b/data/json/decision_points/cvss/modified_privileges_required_1_0_1.json @@ -1,30 +1,30 @@ { - "name": "Modified Privileges Required", - "description": "This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.", "namespace": "cvss", - "version": "1.0.1", - "schemaVersion": "1-0-1", "key": "MPR", + "version": "1.0.1", + "name": "Modified Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.", + "schemaVersion": "2.0.0", "values": [ { "key": "H", "name": "High", - "description": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." + "definition": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." }, { "key": "L", "name": "Low", - "description": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." + "definition": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." }, { "key": "N", "name": "None", - "description": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_scope_1_0_0.json b/data/json/decision_points/cvss/modified_scope_1_0_0.json index 7eb01d1c..ca81fdd3 100644 --- a/data/json/decision_points/cvss/modified_scope_1_0_0.json +++ b/data/json/decision_points/cvss/modified_scope_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Modified Scope", - "description": "the ability for a vulnerability in one software component to impact resources beyond its means, or privileges", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "MS", + "version": "1.0.0", + "name": "Modified Scope", + "definition": "the ability for a vulnerability in one software component to impact resources beyond its means, or privileges", + "schemaVersion": "2.0.0", "values": [ { "key": "U", "name": "Unchanged", - "description": "An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same." + "definition": "An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same." }, { "key": "C", "name": "Changed", - "description": "An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different." + "definition": "An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_subsequent_availability_impact_1_0_0.json b/data/json/decision_points/cvss/modified_subsequent_availability_impact_1_0_0.json deleted file mode 100644 index d8f83c65..00000000 --- a/data/json/decision_points/cvss/modified_subsequent_availability_impact_1_0_0.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "MSA", - "name": "Modified Subsequent Availability Impact", - "description": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", - "values": [ - { - "key": "N", - "name": "Negligible", - "description": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." - }, - { - "key": "L", - "name": "Low", - "description": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." - }, - { - "key": "H", - "name": "High", - "description": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." - }, - { - "key": "X", - "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." - } - ] -} diff --git a/data/json/decision_points/cvss/modified_user_interaction_1_0_0.json b/data/json/decision_points/cvss/modified_user_interaction_1_0_0.json index dab50cf5..87d17ac2 100644 --- a/data/json/decision_points/cvss/modified_user_interaction_1_0_0.json +++ b/data/json/decision_points/cvss/modified_user_interaction_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Modified User Interaction", - "description": "This metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "MUI", + "version": "1.0.0", + "name": "Modified User Interaction", + "definition": "This metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component.", + "schemaVersion": "2.0.0", "values": [ { "key": "R", "name": "Required", - "description": "Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited." + "definition": "Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited." }, { "key": "N", "name": "None", - "description": "The vulnerable system can be exploited without interaction from any user." + "definition": "The vulnerable system can be exploited without interaction from any user." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/modified_user_interaction_2_0_0.json b/data/json/decision_points/cvss/modified_user_interaction_2_0_0.json index 2fbfe36b..e2964a66 100644 --- a/data/json/decision_points/cvss/modified_user_interaction_2_0_0.json +++ b/data/json/decision_points/cvss/modified_user_interaction_2_0_0.json @@ -1,30 +1,30 @@ { - "name": "Modified User Interaction", - "description": "This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "MUI", + "version": "2.0.0", + "name": "Modified User Interaction", + "definition": "This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required.", + "schemaVersion": "2.0.0", "values": [ { "key": "A", "name": "Active", - "description": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." + "definition": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." }, { "key": "P", "name": "Passive", - "description": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." + "definition": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." }, { "key": "N", "name": "None", - "description": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." + "definition": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/privileges_required_1_0_0.json b/data/json/decision_points/cvss/privileges_required_1_0_0.json index 0f918c46..1916bf3a 100644 --- a/data/json/decision_points/cvss/privileges_required_1_0_0.json +++ b/data/json/decision_points/cvss/privileges_required_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Privileges Required", - "description": "This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "PR", + "version": "1.0.0", + "name": "Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "H", "name": "High", - "description": "The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files." + "definition": "The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files." }, { "key": "L", "name": "Low", - "description": "The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources." + "definition": "The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources." }, { "key": "N", "name": "None", - "description": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." } ] } diff --git a/data/json/decision_points/cvss/privileges_required_1_0_1.json b/data/json/decision_points/cvss/privileges_required_1_0_1.json index 698e4dc3..0674b8e2 100644 --- a/data/json/decision_points/cvss/privileges_required_1_0_1.json +++ b/data/json/decision_points/cvss/privileges_required_1_0_1.json @@ -1,25 +1,25 @@ { - "name": "Privileges Required", - "description": "This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.", "namespace": "cvss", - "version": "1.0.1", - "schemaVersion": "1-0-1", "key": "PR", + "version": "1.0.1", + "name": "Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.", + "schemaVersion": "2.0.0", "values": [ { "key": "H", "name": "High", - "description": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." + "definition": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." }, { "key": "L", "name": "Low", - "description": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." + "definition": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." }, { "key": "N", "name": "None", - "description": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." } ] } diff --git a/data/json/decision_points/cvss/provider_urgency_1_0_0.json b/data/json/decision_points/cvss/provider_urgency_1_0_0.json index 6a319c77..902c7d71 100644 --- a/data/json/decision_points/cvss/provider_urgency_1_0_0.json +++ b/data/json/decision_points/cvss/provider_urgency_1_0_0.json @@ -1,35 +1,35 @@ { - "name": "Provider Urgency", - "description": "Many vendors currently provide supplemental severity ratings to consumers via product security advisories. Other vendors publish Qualitative Severity Ratings from the CVSS Specification Document in their advisories. To facilitate a standardized method to incorporate additional provider-supplied assessment, an optional \"pass-through\" Supplemental Metric called Provider Urgency is available.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "U", + "version": "1.0.0", + "name": "Provider Urgency", + "definition": "Many vendors currently provide supplemental severity ratings to consumers via product security advisories. Other vendors publish Qualitative Severity Ratings from the CVSS Specification Document in their advisories. To facilitate a standardized method to incorporate additional provider-supplied assessment, an optional \"pass-through\" Supplemental Metric called Provider Urgency is available.", + "schemaVersion": "2.0.0", "values": [ { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." }, { "key": "C", "name": "Clear", - "description": "Provider has assessed the impact of this vulnerability as having no urgency (Informational)." + "definition": "Provider has assessed the impact of this vulnerability as having no urgency (Informational)." }, { "key": "G", "name": "Green", - "description": "Provider has assessed the impact of this vulnerability as having a reduced urgency." + "definition": "Provider has assessed the impact of this vulnerability as having a reduced urgency." }, { "key": "A", "name": "Amber", - "description": "Provider has assessed the impact of this vulnerability as having a moderate urgency." + "definition": "Provider has assessed the impact of this vulnerability as having a moderate urgency." }, { "key": "R", "name": "Red", - "description": "Provider has assessed the impact of this vulnerability as having the highest urgency." + "definition": "Provider has assessed the impact of this vulnerability as having the highest urgency." } ] } diff --git a/data/json/decision_points/cvss/recovery_1_0_0.json b/data/json/decision_points/cvss/recovery_1_0_0.json index b8597662..31fd5b62 100644 --- a/data/json/decision_points/cvss/recovery_1_0_0.json +++ b/data/json/decision_points/cvss/recovery_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Recovery", - "description": "The Recovery metric describes the resilience of a system to recover services, in terms of performance and availability, after an attack has been performed.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "R", + "version": "1.0.0", + "name": "Recovery", + "definition": "The Recovery metric describes the resilience of a system to recover services, in terms of performance and availability, after an attack has been performed.", + "schemaVersion": "2.0.0", "values": [ { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." }, { "key": "A", "name": "Automatic", - "description": "The system recovers services automatically after an attack has been performed." + "definition": "The system recovers services automatically after an attack has been performed." }, { "key": "U", "name": "User", - "description": "The system requires manual intervention by the user to recover services, after an attack has been performed." + "definition": "The system requires manual intervention by the user to recover services, after an attack has been performed." }, { "key": "I", "name": "Irrecoverable", - "description": "The system services are irrecoverable by the user, after an attack has been performed." + "definition": "The system services are irrecoverable by the user, after an attack has been performed." } ] } diff --git a/data/json/decision_points/cvss/remediation_level_1_0_0.json b/data/json/decision_points/cvss/remediation_level_1_0_0.json index cc5a3866..7210259e 100644 --- a/data/json/decision_points/cvss/remediation_level_1_0_0.json +++ b/data/json/decision_points/cvss/remediation_level_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Remediation Level", - "description": "This metric measures the remediation status of a vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "RL", + "version": "1.0.0", + "name": "Remediation Level", + "definition": "This metric measures the remediation status of a vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "OF", "name": "Official Fix", - "description": "A complete vendor solution is available. Either the vendor has issued the final, official patch which eliminates the vulnerability or an upgrade that is not vulnerable is available." + "definition": "A complete vendor solution is available. Either the vendor has issued the final, official patch which eliminates the vulnerability or an upgrade that is not vulnerable is available." }, { "key": "TF", "name": "Temporary Fix", - "description": "There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool or official workaround." + "definition": "There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool or official workaround." }, { "key": "W", "name": "Workaround", - "description": "There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate against the vulnerability. When it is generally accepted that these unofficial fixes are adequate in plugging the hole for the mean time and no official remediation is available, this value can be set." + "definition": "There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate against the vulnerability. When it is generally accepted that these unofficial fixes are adequate in plugging the hole for the mean time and no official remediation is available, this value can be set." }, { "key": "U", "name": "Unavailable", - "description": "There is either no solution available or it is impossible to apply." + "definition": "There is either no solution available or it is impossible to apply." } ] } diff --git a/data/json/decision_points/cvss/remediation_level_1_1_0.json b/data/json/decision_points/cvss/remediation_level_1_1_0.json index eda1100a..81216ea5 100644 --- a/data/json/decision_points/cvss/remediation_level_1_1_0.json +++ b/data/json/decision_points/cvss/remediation_level_1_1_0.json @@ -1,35 +1,35 @@ { - "name": "Remediation Level", - "description": "This metric measures the remediation status of a vulnerability.", "namespace": "cvss", - "version": "1.1.0", - "schemaVersion": "1-0-1", "key": "RL", + "version": "1.1.0", + "name": "Remediation Level", + "definition": "This metric measures the remediation status of a vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "OF", "name": "Official Fix", - "description": "A complete vendor solution is available. Either the vendor has issued the final, official patch which eliminates the vulnerability or an upgrade that is not vulnerable is available." + "definition": "A complete vendor solution is available. Either the vendor has issued the final, official patch which eliminates the vulnerability or an upgrade that is not vulnerable is available." }, { "key": "TF", "name": "Temporary Fix", - "description": "There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool or official workaround." + "definition": "There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool or official workaround." }, { "key": "W", "name": "Workaround", - "description": "There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate against the vulnerability. When it is generally accepted that these unofficial fixes are adequate in plugging the hole for the mean time and no official remediation is available, this value can be set." + "definition": "There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate against the vulnerability. When it is generally accepted that these unofficial fixes are adequate in plugging the hole for the mean time and no official remediation is available, this value can be set." }, { "key": "U", "name": "Unavailable", - "description": "There is either no solution available or it is impossible to apply." + "definition": "There is either no solution available or it is impossible to apply." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/report_confidence_1_0_0.json b/data/json/decision_points/cvss/report_confidence_1_0_0.json index 0dc24b8b..5df2b995 100644 --- a/data/json/decision_points/cvss/report_confidence_1_0_0.json +++ b/data/json/decision_points/cvss/report_confidence_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Report Confidence", - "description": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "RC", + "version": "1.0.0", + "name": "Report Confidence", + "definition": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", + "schemaVersion": "2.0.0", "values": [ { "key": "UC", "name": "Unconfirmed", - "description": "A single unconfirmed source or possibly several conflicting reports. There is little confidence in the validity of the report." + "definition": "A single unconfirmed source or possibly several conflicting reports. There is little confidence in the validity of the report." }, { "key": "UR", "name": "Uncorroborated", - "description": "Multiple non-official sources; possibily including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity." + "definition": "Multiple non-official sources; possibily including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity." }, { "key": "C", "name": "Confirmed", - "description": "Vendor or author of the affected technology has acknowledged that the vulnerability exists. This value may also be set when existence of a vulnerability is confirmed with absolute confidence through some other event, such as publication of functional proof of concept exploit code or widespread exploitation." + "definition": "Vendor or author of the affected technology has acknowledged that the vulnerability exists. This value may also be set when existence of a vulnerability is confirmed with absolute confidence through some other event, such as publication of functional proof of concept exploit code or widespread exploitation." } ] } diff --git a/data/json/decision_points/cvss/report_confidence_1_1_0.json b/data/json/decision_points/cvss/report_confidence_1_1_0.json index c3c2b7aa..e817cb30 100644 --- a/data/json/decision_points/cvss/report_confidence_1_1_0.json +++ b/data/json/decision_points/cvss/report_confidence_1_1_0.json @@ -1,30 +1,30 @@ { - "name": "Report Confidence", - "description": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", "namespace": "cvss", - "version": "1.1.0", - "schemaVersion": "1-0-1", "key": "RC", + "version": "1.1.0", + "name": "Report Confidence", + "definition": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", + "schemaVersion": "2.0.0", "values": [ { "key": "UC", "name": "Unconfirmed", - "description": "A single unconfirmed source or possibly several conflicting reports. There is little confidence in the validity of the report." + "definition": "A single unconfirmed source or possibly several conflicting reports. There is little confidence in the validity of the report." }, { "key": "UR", "name": "Uncorroborated", - "description": "Multiple non-official sources; possibily including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity." + "definition": "Multiple non-official sources; possibily including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity." }, { "key": "C", "name": "Confirmed", - "description": "Vendor or author of the affected technology has acknowledged that the vulnerability exists. This value may also be set when existence of a vulnerability is confirmed with absolute confidence through some other event, such as publication of functional proof of concept exploit code or widespread exploitation." + "definition": "Vendor or author of the affected technology has acknowledged that the vulnerability exists. This value may also be set when existence of a vulnerability is confirmed with absolute confidence through some other event, such as publication of functional proof of concept exploit code or widespread exploitation." }, { "key": "ND", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/report_confidence_2_0_0.json b/data/json/decision_points/cvss/report_confidence_2_0_0.json index cf6cf0ca..50efb8f1 100644 --- a/data/json/decision_points/cvss/report_confidence_2_0_0.json +++ b/data/json/decision_points/cvss/report_confidence_2_0_0.json @@ -1,30 +1,30 @@ { - "name": "Report Confidence", - "description": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "RC", + "version": "2.0.0", + "name": "Report Confidence", + "definition": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", + "schemaVersion": "2.0.0", "values": [ { "key": "U", "name": "Unknown", - "description": "There are reports of impacts that indicate a vulnerability is present. The reports indicate that the cause of the vulnerability is unknown, or reports may differ on the cause or impacts of the vulnerability. Reporters are uncertain of the true nature of the vulnerability, and there is little confidence in the validity of the reports or whether a static Base score can be applied given the differences described." + "definition": "There are reports of impacts that indicate a vulnerability is present. The reports indicate that the cause of the vulnerability is unknown, or reports may differ on the cause or impacts of the vulnerability. Reporters are uncertain of the true nature of the vulnerability, and there is little confidence in the validity of the reports or whether a static Base score can be applied given the differences described." }, { "key": "R", "name": "Reasonable", - "description": "Significant details are published, but researchers either do not have full confidence in the root cause, or do not have access to source code to fully confirm all of the interactions that may lead to the result. Reasonable confidence exists, however, that the bug is reproducible and at least one impact is able to be verified (proof-of-concept exploits may provide this)." + "definition": "Significant details are published, but researchers either do not have full confidence in the root cause, or do not have access to source code to fully confirm all of the interactions that may lead to the result. Reasonable confidence exists, however, that the bug is reproducible and at least one impact is able to be verified (proof-of-concept exploits may provide this)." }, { "key": "C", "name": "Confirmed", - "description": "Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability." + "definition": "Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/safety_1_0_0.json b/data/json/decision_points/cvss/safety_1_0_0.json index 987de4d0..3f9ea913 100644 --- a/data/json/decision_points/cvss/safety_1_0_0.json +++ b/data/json/decision_points/cvss/safety_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Safety", - "description": "The Safety decision point is a measure of the potential for harm to humans or the environment.", "namespace": "cvss", + "key": "SF", "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "S", + "name": "Safety", + "definition": "The Safety decision point is a measure of the potential for harm to humans or the environment.", + "schemaVersion": "2.0.0", "values": [ { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." }, { "key": "P", "name": "Present", - "description": "Consequences of the vulnerability meet definition of IEC 61508 consequence categories of \"marginal,\" \"critical,\" or \"catastrophic.\"" + "definition": "Consequences of the vulnerability meet definition of IEC 61508 consequence categories of \"marginal,\" \"critical,\" or \"catastrophic.\"" }, { "key": "N", "name": "Negligible", - "description": "Consequences of the vulnerability meet definition of IEC 61508 consequence category \"negligible.\"" + "definition": "Consequences of the vulnerability meet definition of IEC 61508 consequence category \"negligible.\"" } ] } diff --git a/data/json/decision_points/cvss/scope_1_0_0.json b/data/json/decision_points/cvss/scope_1_0_0.json index 0025ac97..813c4365 100644 --- a/data/json/decision_points/cvss/scope_1_0_0.json +++ b/data/json/decision_points/cvss/scope_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "Scope", - "description": "the ability for a vulnerability in one software component to impact resources beyond its means, or privileges", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "S", + "version": "1.0.0", + "name": "Scope", + "definition": "the ability for a vulnerability in one software component to impact resources beyond its means, or privileges", + "schemaVersion": "2.0.0", "values": [ { "key": "U", "name": "Unchanged", - "description": "An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same." + "definition": "An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same." }, { "key": "C", "name": "Changed", - "description": "An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different." + "definition": "An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different." } ] } diff --git a/data/json/decision_points/cvss/subsequent_availability_impact_1_0_0.json b/data/json/decision_points/cvss/subsequent_availability_impact_1_0_0.json deleted file mode 100644 index a7ed8c04..00000000 --- a/data/json/decision_points/cvss/subsequent_availability_impact_1_0_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "SA", - "name": "Subsequent Availability Impact", - "description": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." - }, - { - "key": "L", - "name": "Low", - "description": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." - }, - { - "key": "H", - "name": "High", - "description": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." - } - ] -} diff --git a/data/json/decision_points/cvss/target_distribution_1_0_0.json b/data/json/decision_points/cvss/target_distribution_1_0_0.json index 97b94297..c6b7e412 100644 --- a/data/json/decision_points/cvss/target_distribution_1_0_0.json +++ b/data/json/decision_points/cvss/target_distribution_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Target Distribution", - "description": "This metric measures the relative size of the field of target systems susceptible to the vulnerability. It is meant as an environment-specific indicator in order to approximate the percentage of systems within the environment that could be affected by the vulnerability.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "TD", + "version": "1.0.0", + "name": "Target Distribution", + "definition": "This metric measures the relative size of the field of target systems susceptible to the vulnerability. It is meant as an environment-specific indicator in order to approximate the percentage of systems within the environment that could be affected by the vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk." + "definition": "No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk." }, { "key": "L", "name": "Low", - "description": "Targets exist inside the environment, but on a small scale. Between 1% - 15% of the total environment is at risk." + "definition": "Targets exist inside the environment, but on a small scale. Between 1% - 15% of the total environment is at risk." }, { "key": "M", "name": "Medium", - "description": "Targets exist inside the environment, but on a medium scale. Between 16% - 49% of the total environment is at risk." + "definition": "Targets exist inside the environment, but on a medium scale. Between 16% - 49% of the total environment is at risk." }, { "key": "H", "name": "High", - "description": "Targets exist inside the environment on a considerable scale. Between 50% - 100% of the total environment is considered at risk." + "definition": "Targets exist inside the environment on a considerable scale. Between 50% - 100% of the total environment is considered at risk." } ] } diff --git a/data/json/decision_points/cvss/target_distribution_1_1_0.json b/data/json/decision_points/cvss/target_distribution_1_1_0.json index 5e0d93f0..90af4d1d 100644 --- a/data/json/decision_points/cvss/target_distribution_1_1_0.json +++ b/data/json/decision_points/cvss/target_distribution_1_1_0.json @@ -1,35 +1,35 @@ { - "name": "Target Distribution", - "description": "This metric measures the relative size of the field of target systems susceptible to the vulnerability. It is meant as an environment-specific indicator in order to approximate the percentage of systems within the environment that could be affected by the vulnerability.", "namespace": "cvss", - "version": "1.1.0", - "schemaVersion": "1-0-1", "key": "TD", + "version": "1.1.0", + "name": "Target Distribution", + "definition": "This metric measures the relative size of the field of target systems susceptible to the vulnerability. It is meant as an environment-specific indicator in order to approximate the percentage of systems within the environment that could be affected by the vulnerability.", + "schemaVersion": "2.0.0", "values": [ { "key": "N", "name": "None", - "description": "No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk." + "definition": "No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk." }, { "key": "L", "name": "Low", - "description": "Targets exist inside the environment, but on a small scale. Between 1% - 15% of the total environment is at risk." + "definition": "Targets exist inside the environment, but on a small scale. Between 1% - 15% of the total environment is at risk." }, { "key": "M", "name": "Medium", - "description": "Targets exist inside the environment, but on a medium scale. Between 16% - 49% of the total environment is at risk." + "definition": "Targets exist inside the environment, but on a medium scale. Between 16% - 49% of the total environment is at risk." }, { "key": "H", "name": "High", - "description": "Targets exist inside the environment on a considerable scale. Between 50% - 100% of the total environment is considered at risk." + "definition": "Targets exist inside the environment on a considerable scale. Between 50% - 100% of the total environment is considered at risk." }, { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." } ] } diff --git a/data/json/decision_points/cvss/user_interaction_1_0_0.json b/data/json/decision_points/cvss/user_interaction_1_0_0.json index eb4e9bfb..de29297c 100644 --- a/data/json/decision_points/cvss/user_interaction_1_0_0.json +++ b/data/json/decision_points/cvss/user_interaction_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "User Interaction", - "description": "This metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "UI", + "version": "1.0.0", + "name": "User Interaction", + "definition": "This metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component.", + "schemaVersion": "2.0.0", "values": [ { "key": "R", "name": "Required", - "description": "Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited." + "definition": "Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited." }, { "key": "N", "name": "None", - "description": "The vulnerable system can be exploited without interaction from any user." + "definition": "The vulnerable system can be exploited without interaction from any user." } ] } diff --git a/data/json/decision_points/cvss/user_interaction_2_0_0.json b/data/json/decision_points/cvss/user_interaction_2_0_0.json index 160107aa..4bc2c5f6 100644 --- a/data/json/decision_points/cvss/user_interaction_2_0_0.json +++ b/data/json/decision_points/cvss/user_interaction_2_0_0.json @@ -1,25 +1,25 @@ { - "name": "User Interaction", - "description": "This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required.", "namespace": "cvss", - "version": "2.0.0", - "schemaVersion": "1-0-1", "key": "UI", + "version": "2.0.0", + "name": "User Interaction", + "definition": "This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required.", + "schemaVersion": "2.0.0", "values": [ { "key": "A", "name": "Active", - "description": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." + "definition": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." }, { "key": "P", "name": "Passive", - "description": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." + "definition": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." }, { "key": "N", "name": "None", - "description": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." + "definition": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." } ] } diff --git a/data/json/decision_points/cvss/value_density_1_0_0.json b/data/json/decision_points/cvss/value_density_1_0_0.json index 1ca1a355..1edffbd0 100644 --- a/data/json/decision_points/cvss/value_density_1_0_0.json +++ b/data/json/decision_points/cvss/value_density_1_0_0.json @@ -1,25 +1,25 @@ { - "name": "Value Density", - "description": "Value Density describes the resources that the attacker will gain control over with a single exploitation event. It has two possible values, diffuse and concentrated.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "V", + "version": "1.0.0", + "name": "Value Density", + "definition": "Value Density describes the resources that the attacker will gain control over with a single exploitation event. It has two possible values, diffuse and concentrated.", + "schemaVersion": "2.0.0", "values": [ { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." }, { "key": "D", "name": "Diffuse", - "description": "The vulnerable system has limited resources. That is, the resources that the attacker will gain control over with a single exploitation event are relatively small." + "definition": "The vulnerable system has limited resources. That is, the resources that the attacker will gain control over with a single exploitation event are relatively small." }, { "key": "C", "name": "Concentrated", - "description": "The vulnerable system is rich in resources. Heuristically, such systems are often the direct responsibility of \"system operators\" rather than users." + "definition": "The vulnerable system is rich in resources. Heuristically, such systems are often the direct responsibility of \"system operators\" rather than users." } ] } diff --git a/data/json/decision_points/cvss/vulnerability_response_effort_1_0_0.json b/data/json/decision_points/cvss/vulnerability_response_effort_1_0_0.json index bb334844..be0cb7ca 100644 --- a/data/json/decision_points/cvss/vulnerability_response_effort_1_0_0.json +++ b/data/json/decision_points/cvss/vulnerability_response_effort_1_0_0.json @@ -1,30 +1,30 @@ { - "name": "Vulnerability Response Effort", - "description": "The intention of the Vulnerability Response Effort metric is to provide supplemental information on how difficult it is for consumers to provide an initial response to the impact of vulnerabilities for deployed products and services in their infrastructure. The consumer can then take this additional information on effort required into consideration when applying mitigations and/or scheduling remediation.", "namespace": "cvss", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "RE", + "version": "1.0.0", + "name": "Vulnerability Response Effort", + "definition": "The intention of the Vulnerability Response Effort metric is to provide supplemental information on how difficult it is for consumers to provide an initial response to the impact of vulnerabilities for deployed products and services in their infrastructure. The consumer can then take this additional information on effort required into consideration when applying mitigations and/or scheduling remediation.", + "schemaVersion": "2.0.0", "values": [ { "key": "X", "name": "Not Defined", - "description": "This metric value is not defined. See CVSS documentation for details." + "definition": "This metric value is not defined. See CVSS documentation for details." }, { "key": "L", "name": "Low", - "description": "The effort required to respond to a vulnerability is low/trivial." + "definition": "The effort required to respond to a vulnerability is low/trivial." }, { "key": "M", "name": "Moderate", - "description": "The actions required to respond to a vulnerability require some effort on behalf of the consumer and could cause minimal service impact to implement." + "definition": "The actions required to respond to a vulnerability require some effort on behalf of the consumer and could cause minimal service impact to implement." }, { "key": "H", "name": "High", - "description": "The actions required to respond to a vulnerability are significant and/or difficult, and may possibly lead to an extended, scheduled service impact. This would need to be considered for scheduling purposes including honoring any embargo on deployment of the selected response. Alternatively, response to the vulnerability in the field is not possible remotely. The only resolution to the vulnerability involves physical replacement (e.g. units deployed would have to be recalled for a depot level repair or replacement)." + "definition": "The actions required to respond to a vulnerability are significant and/or difficult, and may possibly lead to an extended, scheduled service impact. This would need to be considered for scheduling purposes including honoring any embargo on deployment of the selected response. Alternatively, response to the vulnerability in the field is not possible remotely. The only resolution to the vulnerability involves physical replacement (e.g. units deployed would have to be recalled for a depot level repair or replacement)." } ] } diff --git a/data/json/decision_points/exploitation_1_0_0.json b/data/json/decision_points/exploitation_1_0_0.json deleted file mode 100644 index d1cf71b2..00000000 --- a/data/json/decision_points/exploitation_1_0_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "Exploitation", - "description": "The present state of exploitation of the vulnerability.", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "E", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." - }, - { - "key": "P", - "name": "PoC", - "description": "One of the following cases is true: (1) private evidence of exploitation is attested but not shared; (2) widespread hearsay attests to exploitation; (3) typical public PoC in places such as Metasploit or ExploitDB; or (4) the vulnerability has a well-known method of exploitation." - }, - { - "key": "A", - "name": "Active", - "description": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." - } - ] -} diff --git a/data/json/decision_points/exploitation_1_1_0.json b/data/json/decision_points/exploitation_1_1_0.json deleted file mode 100644 index e54d2ace..00000000 --- a/data/json/decision_points/exploitation_1_1_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "Exploitation", - "description": "The present state of exploitation of the vulnerability.", - "namespace": "ssvc", - "version": "1.1.0", - "schemaVersion": "1-0-1", - "key": "E", - "values": [ - { - "key": "N", - "name": "None", - "description": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." - }, - { - "key": "P", - "name": "Public PoC", - "description": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." - }, - { - "key": "A", - "name": "Active", - "description": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." - } - ] -} diff --git a/data/json/decision_points/human_impact_1_0_0.json b/data/json/decision_points/human_impact_1_0_0.json deleted file mode 100644 index 051c3789..00000000 --- a/data/json/decision_points/human_impact_1_0_0.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "schemaVersion": "1-0-1", - "namespace": "ssvc", - "version": "1.0.0", - "key": "HI", - "name": "Human Impact", - "description": "Human Impact is a combination of Safety and Mission impacts.", - "values": [ - { - "key": "L", - "name": "Low", - "description": "Safety Impact:(None OR Minor) AND Mission Impact:(None OR Degraded OR Crippled)" - }, - { - "key": "M", - "name": "Medium", - "description": "(Safety Impact:(None OR Minor) AND Mission Impact:MEF Failure) OR (Safety Impact:Major AND Mission Impact:(None OR Degraded OR Crippled))" - }, - { - "key": "H", - "name": "High", - "description": "(Safety Impact:Hazardous AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Major AND Mission Impact:MEF Failure)" - }, - { - "key": "VH", - "name": "Very High", - "description": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" - } - ] -} \ No newline at end of file diff --git a/data/json/decision_points/human_impact_2_0_0.json b/data/json/decision_points/human_impact_2_0_0.json deleted file mode 100644 index 80af1b78..00000000 --- a/data/json/decision_points/human_impact_2_0_0.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "name": "Human Impact", - "description": "Human Impact is a combination of Safety and Mission impacts.", - "namespace": "ssvc", - "version": "2.0.0", - "schemaVersion": "1-0-1", - "key": "HI", - "values": [ - { - "key": "L", - "name": "Low", - "description": "Safety Impact:(None OR Minor) AND Mission Impact:(None OR Degraded OR Crippled)" - }, - { - "key": "M", - "name": "Medium", - "description": "(Safety Impact:(None OR Minor) AND Mission Impact:MEF Failure) OR (Safety Impact:Major AND Mission Impact:(None OR Degraded OR Crippled))" - }, - { - "key": "H", - "name": "High", - "description": "(Safety Impact:Hazardous AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Major AND Mission Impact:MEF Failure)" - }, - { - "key": "VH", - "name": "Very High", - "description": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" - } - ] -} diff --git a/data/json/decision_points/human_impact_2_0_1.json b/data/json/decision_points/human_impact_2_0_1.json deleted file mode 100644 index 3942e93a..00000000 --- a/data/json/decision_points/human_impact_2_0_1.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "name": "Human Impact", - "description": "Human Impact is a combination of Safety and Mission impacts.", - "namespace": "ssvc", - "version": "2.0.1", - "schemaVersion": "1-0-1", - "key": "HI", - "values": [ - { - "key": "L", - "name": "Low", - "description": "Safety Impact:(Negligible) AND Mission Impact:(None OR Degraded OR Crippled)" - }, - { - "key": "M", - "name": "Medium", - "description": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(None OR Degraded OR Crippled))" - }, - { - "key": "H", - "name": "High", - "description": "(Safety Impact:Critical AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" - }, - { - "key": "VH", - "name": "Very High", - "description": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" - } - ] -} diff --git a/data/json/decision_points/mission_and_well-being_impact_1_0_0.json b/data/json/decision_points/mission_and_well-being_impact_1_0_0.json deleted file mode 100644 index 95de41e6..00000000 --- a/data/json/decision_points/mission_and_well-being_impact_1_0_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "Mission and Well-Being Impact", - "description": "Mission and Well-Being Impact is a combination of Mission Prevalence and Public Well-Being Impact.", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "MWI", - "values": [ - { - "key": "L", - "name": "Low", - "description": "Mission Prevalence:Minimal AND Public Well-Being Impact:Minimal" - }, - { - "key": "M", - "name": "Medium", - "description": "Mission Prevalence:Support AND Public Well-Being Impact:(Minimal OR Material)" - }, - { - "key": "H", - "name": "High", - "description": "Mission Prevalence:Essential OR Public Well-Being Impact:(Irreversible)" - } - ] -} diff --git a/data/json/decision_points/mission_impact_1_0_0.json b/data/json/decision_points/mission_impact_1_0_0.json deleted file mode 100644 index ac6b2915..00000000 --- a/data/json/decision_points/mission_impact_1_0_0.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "name": "Mission Impact", - "description": "Impact on Mission Essential Functions of the Organization", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "MI", - "values": [ - { - "key": "N", - "name": "None", - "description": "Little to no impact" - }, - { - "key": "NED", - "name": "Non-Essential Degraded", - "description": "Degradation of non-essential functions; chronic degradation would eventually harm essential functions" - }, - { - "key": "MSC", - "name": "MEF Support Crippled", - "description": "Activities that directly support essential functions are crippled; essential functions continue for a time" - }, - { - "key": "MEF", - "name": "MEF Failure", - "description": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" - }, - { - "key": "MF", - "name": "Mission Failure", - "description": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" - } - ] -} diff --git a/data/json/decision_points/mission_impact_2_0_0.json b/data/json/decision_points/mission_impact_2_0_0.json deleted file mode 100644 index b0a3fc77..00000000 --- a/data/json/decision_points/mission_impact_2_0_0.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "name": "Mission Impact", - "description": "Impact on Mission Essential Functions of the Organization", - "namespace": "ssvc", - "version": "2.0.0", - "schemaVersion": "1-0-1", - "key": "MI", - "values": [ - { - "key": "D", - "name": "Degraded", - "description": "Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions" - }, - { - "key": "MSC", - "name": "MEF Support Crippled", - "description": "Activities that directly support essential functions are crippled; essential functions continue for a time" - }, - { - "key": "MEF", - "name": "MEF Failure", - "description": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" - }, - { - "key": "MF", - "name": "Mission Failure", - "description": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" - } - ] -} diff --git a/data/json/decision_points/nist_800_30/probability_scale_in_5_weighted_levels_ascending_1_0_0.json b/data/json/decision_points/nist_800_30/probability_scale_in_5_weighted_levels_ascending_1_0_0.json new file mode 100644 index 00000000..2422981f --- /dev/null +++ b/data/json/decision_points/nist_800_30/probability_scale_in_5_weighted_levels_ascending_1_0_0.json @@ -0,0 +1,35 @@ +{ + "namespace": "nist#800-30", + "key": "P_5X", + "version": "1.0.0", + "name": "Probability Scale in 5 weighted levels, ascending", + "definition": "A probability scale with finer resolution at both extremes, based on NIST SP 800-30 Rev. 1 Appendix G", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "VL", + "name": "Very Low", + "definition": "0% <= Probability < 5%. Highly unlikely." + }, + { + "key": "L", + "name": "Low", + "definition": "5% <= Probability < 21%. Unlikely." + }, + { + "key": "M", + "name": "Moderate", + "definition": "21% <= Probability < 80%. Somewhat likely." + }, + { + "key": "H", + "name": "High", + "definition": "80% <= Probability < 96%. Highly likely." + }, + { + "key": "VH", + "name": "Very High", + "definition": "96% <= Probability <= 100%. Almost certain." + } + ] +} diff --git a/data/json/decision_points/public_safety_impact_1_0_0.json b/data/json/decision_points/public_safety_impact_1_0_0.json deleted file mode 100644 index 0426c72b..00000000 --- a/data/json/decision_points/public_safety_impact_1_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "schemaVersion": "1-0-1", - "namespace": "ssvc", - "version": "1.0.0", - "key": "PSI", - "name": "Public Safety Impact", - "description": "A coarse-grained representation of impact to public safety.", - "values": [ - { - "key": "M", - "name": "Minimal", - "description": "Safety Impact:(None OR Minor)" - }, - { - "key": "S", - "name": "Significant", - "description": "Safety Impact:(Major OR Hazardous OR Catastrophic)" - } - ] -} \ No newline at end of file diff --git a/data/json/decision_points/public_safety_impact_2_0_0.json b/data/json/decision_points/public_safety_impact_2_0_0.json deleted file mode 100644 index 74b06423..00000000 --- a/data/json/decision_points/public_safety_impact_2_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Public Safety Impact", - "description": "A coarse-grained representation of impact to public safety.", - "namespace": "ssvc", - "version": "2.0.0", - "schemaVersion": "1-0-1", - "key": "PSI", - "values": [ - { - "key": "M", - "name": "Minimal", - "description": "Safety Impact:(None OR Minor)" - }, - { - "key": "S", - "name": "Significant", - "description": "Safety Impact:(Major OR Hazardous OR Catastrophic)" - } - ] -} diff --git a/data/json/decision_points/public_value_added_1_0_0.json b/data/json/decision_points/public_value_added_1_0_0.json deleted file mode 100644 index ae508569..00000000 --- a/data/json/decision_points/public_value_added_1_0_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "Public Value Added", - "description": "How much value would a publication from the coordinator benefit the broader community?", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "PVA", - "values": [ - { - "key": "L", - "name": "Limited", - "description": "Minimal value added to the existing public information because existing information is already high quality and in multiple outlets." - }, - { - "key": "A", - "name": "Ampliative", - "description": "Amplifies and/or augments the existing public information about the vulnerability, for example, adds additional detail, addresses or corrects errors in other public information, draws further attention to the vulnerability, etc." - }, - { - "key": "P", - "name": "Precedence", - "description": "The publication would be the first publicly available, or be coincident with the first publicly available." - } - ] -} diff --git a/data/json/decision_points/public_well-being_impact_1_0_0.json b/data/json/decision_points/public_well-being_impact_1_0_0.json deleted file mode 100644 index 7994e948..00000000 --- a/data/json/decision_points/public_well-being_impact_1_0_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "Public Well-Being Impact", - "description": "A coarse-grained representation of impact to public well-being.", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "PWI", - "values": [ - { - "key": "M", - "name": "Minimal", - "description": "The effect is below the threshold for all aspects described in material. " - }, - { - "key": "M", - "name": "Material", - "description": "Any one or more of these conditions hold. Physical harm: Does one or more of the following: (a) Causes physical distress or injury to system users. (b) Introduces occupational safety hazards. (c) Reduces and/or results in failure of cyber-physical system safety margins. Environment: Major externalities (property damage, environmental damage, etc.) are imposed on other parties. Financial: Financial losses likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to necessitate counseling or therapy, impact populations of people. " - }, - { - "key": "I", - "name": "Irreversible", - "description": "Any one or more of these conditions hold. Physical harm: One or both of the following are true: (a) Multiple fatalities are likely.(b) The cyber-physical system, of which the vulnerable componen is a part, is likely lost or destroyed. Environment: Extreme or serious externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) are imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software are destabilized and potentially collapse. Psychological: N/A " - } - ] -} diff --git a/data/json/decision_points/report_public_1_0_0.json b/data/json/decision_points/report_public_1_0_0.json deleted file mode 100644 index 5c4d19d8..00000000 --- a/data/json/decision_points/report_public_1_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Report Public", - "description": "Is a viable report of the details of the vulnerability already publicly available?", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "RP", - "values": [ - { - "key": "Y", - "name": "Yes", - "description": "A public report of the vulnerability exists." - }, - { - "key": "N", - "name": "No", - "description": "No public report of the vulnerability exists." - } - ] -} diff --git a/data/json/decision_points/safety_impact_1_0_0.json b/data/json/decision_points/safety_impact_1_0_0.json deleted file mode 100644 index fe240916..00000000 --- a/data/json/decision_points/safety_impact_1_0_0.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "name": "Safety Impact", - "description": "The safety impact of the vulnerability.", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "SI", - "values": [ - { - "key": "N", - "name": "None", - "description": "The effect is below the threshold for all aspects described in Minor." - }, - { - "key": "M", - "name": "Minor", - "description": "Any one or more of these conditions hold. Physical harm: Physical discomfort for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. System resiliency: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. Environment: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. Financial Financial losses, which are not readily absorbable, to multiple persons. Psychological: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." - }, - { - "key": "J", - "name": "Major", - "description": "Any one or more of these conditions hold. Physical harm: Physical distress and injuries for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. System resiliency: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. Environment: Major externalities (property damage, environmental damage, etc.) imposed on other parties. Financial: Financial losses that likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." - }, - { - "key": "H", - "name": "Hazardous", - "description": "Any one or more of these conditions hold. Physical harm: Serious or fatal injuries, where fatalities are plausibly preventable via emergency services or other measures. Operator resiliency: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. System resiliency: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. Environment: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. Financial: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. Psychological: N/A." - }, - { - "key": "C", - "name": "Catastrophic", - "description": "Any one or more of these conditions hold. Physical harm: Multiple immediate fatalities (Emergency response probably cannot save the victims.) Operator resiliency: Operator incapacitated (includes fatality or otherwise incapacitated). System resiliency: Total loss of whole cyber-physical system, of which the software is a part. Environment: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software collapse. Psychological: N/A." - } - ] -} diff --git a/data/json/decision_points/safety_impact_2_0_0.json b/data/json/decision_points/safety_impact_2_0_0.json deleted file mode 100644 index 4f839fb8..00000000 --- a/data/json/decision_points/safety_impact_2_0_0.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "name": "Safety Impact", - "description": "The safety impact of the vulnerability. (based on IEC 61508)", - "namespace": "ssvc", - "version": "2.0.0", - "schemaVersion": "1-0-1", - "key": "SI", - "values": [ - { - "key": "N", - "name": "Negligible", - "description": "Any one or more of these conditions hold.

- *Physical harm*: Minor injuries at worst (IEC 61508 Negligible).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard.
- *System resiliency*: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation.
- *Environment*: Minor externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses, which are not readily absorbable, to multiple persons.
- *Psychological*: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." - }, - { - "key": "M", - "name": "Marginal", - "description": "Any one or more of these conditions hold.

- *Physical harm*: Major injuries to one or more persons (IEC 61508 Marginal).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard.
- *System resiliency*: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation.
- *Environment*: Major externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses that likely lead to bankruptcy of multiple persons.
- *Psychological*: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." - }, - { - "key": "R", - "name": "Critical", - "description": "Any one or more of these conditions hold.

- *Physical harm*: Loss of life (IEC 61508 Critical).
- *Operator resiliency*: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly.
- *System resiliency*: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact.
- *Environment*: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties.
- *Financial*: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state.
- *Psychological*: N/A." - }, - { - "key": "C", - "name": "Catastrophic", - "description": "Any one or more of these conditions hold.

- *Physical harm*: Multiple loss of life (IEC 61508 Catastrophic).
- *Operator resiliency*: Operator incapacitated (includes fatality or otherwise incapacitated).
- *System resiliency*: Total loss of whole cyber-physical system, of which the software is a part.
- *Environment*: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties.
- *Financial*: Social systems (elections, financial grid, etc.) supported by the software collapse.
- *Psychological*: N/A." - } - ] -} diff --git a/data/json/decision_points/ssvc/automatable_2_0_0.json b/data/json/decision_points/ssvc/automatable_2_0_0.json new file mode 100644 index 00000000..858c79c0 --- /dev/null +++ b/data/json/decision_points/ssvc/automatable_2_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "A", + "version": "2.0.0", + "name": "Automatable", + "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + ] +} diff --git a/data/json/decision_points/ssvc/critical_software_1_0_0.json b/data/json/decision_points/ssvc/critical_software_1_0_0.json new file mode 100644 index 00000000..7a3867f7 --- /dev/null +++ b/data/json/decision_points/ssvc/critical_software_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "CS", + "version": "1.0.0", + "name": "Critical Software", + "definition": "Denotes whether a system meets a critical software definition.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "System does not meet a critical software definition." + }, + { + "key": "Y", + "name": "Yes", + "definition": "System meets a critical software definition." + } + ] +} diff --git a/data/json/outcomes/COORDINATE.json b/data/json/decision_points/ssvc/decline_track_coordinate_1_0_0.json similarity index 50% rename from data/json/outcomes/COORDINATE.json rename to data/json/decision_points/ssvc/decline_track_coordinate_1_0_0.json index 67a4d9fa..5457a1d9 100644 --- a/data/json/outcomes/COORDINATE.json +++ b/data/json/decision_points/ssvc/decline_track_coordinate_1_0_0.json @@ -1,23 +1,25 @@ { + "namespace": "ssvc", + "key": "COORDINATE", "version": "1.0.0", - "schemaVersion": "1-0-1", "name": "Decline, Track, Coordinate", - "description": "The coordinate outcome group.", - "outcomes": [ + "definition": "The coordinate outcome group.", + "schemaVersion": "2.0.0", + "values": [ { "key": "D", "name": "Decline", - "description": "Decline" + "definition": "Decline" }, { "key": "T", "name": "Track", - "description": "Track" + "definition": "Track" }, { "key": "C", "name": "Coordinate", - "description": "Coordinate" + "definition": "Coordinate" } ] -} \ No newline at end of file +} diff --git a/data/json/decision_points/ssvc/decline_track_coordinate_1_0_1.json b/data/json/decision_points/ssvc/decline_track_coordinate_1_0_1.json new file mode 100644 index 00000000..3a4041cb --- /dev/null +++ b/data/json/decision_points/ssvc/decline_track_coordinate_1_0_1.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "COORDINATE", + "version": "1.0.1", + "name": "Decline, Track, Coordinate", + "definition": "The coordinate outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Decline", + "definition": "Do not act on the report." + }, + { + "key": "T", + "name": "Track", + "definition": "Receive information about the vulnerability and monitor for status changes but do not take any overt actions." + }, + { + "key": "C", + "name": "Coordinate", + "definition": "Take action on the report." + } + ] +} diff --git a/data/json/outcomes/DSOI.json b/data/json/decision_points/ssvc/defer_scheduled_out_of_cycle_immediate_1_0_0.json similarity index 54% rename from data/json/outcomes/DSOI.json rename to data/json/decision_points/ssvc/defer_scheduled_out_of_cycle_immediate_1_0_0.json index 8e16b6f6..98b78916 100644 --- a/data/json/outcomes/DSOI.json +++ b/data/json/decision_points/ssvc/defer_scheduled_out_of_cycle_immediate_1_0_0.json @@ -1,28 +1,30 @@ { + "namespace": "ssvc", + "key": "DSOI", "version": "1.0.0", - "schemaVersion": "1-0-1", "name": "Defer, Scheduled, Out-of-Cycle, Immediate", - "description": "The original SSVC outcome group.", - "outcomes": [ + "definition": "The original SSVC outcome group.", + "schemaVersion": "2.0.0", + "values": [ { "key": "D", "name": "Defer", - "description": "Defer" + "definition": "Defer" }, { "key": "S", "name": "Scheduled", - "description": "Scheduled" + "definition": "Scheduled" }, { "key": "O", "name": "Out-of-Cycle", - "description": "Out-of-Cycle" + "definition": "Out-of-Cycle" }, { "key": "I", "name": "Immediate", - "description": "Immediate" + "definition": "Immediate" } ] -} \ No newline at end of file +} diff --git a/data/json/decision_points/ssvc/exploitation_1_0_0.json b/data/json/decision_points/ssvc/exploitation_1_0_0.json new file mode 100644 index 00000000..bdae60b9 --- /dev/null +++ b/data/json/decision_points/ssvc/exploitation_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "E", + "version": "1.0.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "PoC", + "definition": "One of the following cases is true: (1) private evidence of exploitation is attested but not shared; (2) widespread hearsay attests to exploitation; (3) typical public PoC in places such as Metasploit or ExploitDB; or (4) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] +} diff --git a/data/json/decision_points/ssvc/exploitation_1_1_0.json b/data/json/decision_points/ssvc/exploitation_1_1_0.json new file mode 100644 index 00000000..d1eb2fb9 --- /dev/null +++ b/data/json/decision_points/ssvc/exploitation_1_1_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] +} diff --git a/data/json/decision_points/ssvc/high_value_asset_1_0_0.json b/data/json/decision_points/ssvc/high_value_asset_1_0_0.json new file mode 100644 index 00000000..f12e832e --- /dev/null +++ b/data/json/decision_points/ssvc/high_value_asset_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "HVA", + "version": "1.0.0", + "name": "High Value Asset", + "definition": "Denotes whether a system meets a high value asset definition.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "System does not meet a high value asset definition." + }, + { + "key": "Y", + "name": "Yes", + "definition": "System meets a high value asset definition." + } + ] +} diff --git a/data/json/decision_points/ssvc/human_impact_2_0_0.json b/data/json/decision_points/ssvc/human_impact_2_0_0.json new file mode 100644 index 00000000..9d24b932 --- /dev/null +++ b/data/json/decision_points/ssvc/human_impact_2_0_0.json @@ -0,0 +1,30 @@ +{ + "namespace": "ssvc", + "key": "HI", + "version": "2.0.0", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(None OR Minor) AND Mission Impact:(None OR Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:(None OR Minor) AND Mission Impact:MEF Failure) OR (Safety Impact:Major AND Mission Impact:(None OR Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Hazardous AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Major AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] +} diff --git a/data/json/decision_points/ssvc/human_impact_2_0_1.json b/data/json/decision_points/ssvc/human_impact_2_0_1.json new file mode 100644 index 00000000..58f11f8c --- /dev/null +++ b/data/json/decision_points/ssvc/human_impact_2_0_1.json @@ -0,0 +1,30 @@ +{ + "namespace": "ssvc", + "key": "HI", + "version": "2.0.1", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(None OR Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(None OR Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] +} diff --git a/data/json/decision_points/ssvc/human_impact_2_0_2.json b/data/json/decision_points/ssvc/human_impact_2_0_2.json new file mode 100644 index 00000000..ab777d65 --- /dev/null +++ b/data/json/decision_points/ssvc/human_impact_2_0_2.json @@ -0,0 +1,30 @@ +{ + "namespace": "ssvc", + "key": "HI", + "version": "2.0.2", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] +} diff --git a/data/json/decision_points/ssvc/mission_and_well_being_impact_1_0_0.json b/data/json/decision_points/ssvc/mission_and_well_being_impact_1_0_0.json new file mode 100644 index 00000000..1ac6533d --- /dev/null +++ b/data/json/decision_points/ssvc/mission_and_well_being_impact_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "MWI", + "version": "1.0.0", + "name": "Mission and Well-Being Impact", + "definition": "Mission and Well-Being Impact is a combination of Mission Prevalence and Public Well-Being Impact.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Mission Prevalence:Minimal AND Public Well-Being Impact:Minimal" + }, + { + "key": "M", + "name": "Medium", + "definition": "Mission Prevalence:Support AND Public Well-Being Impact:(Minimal OR Material)" + }, + { + "key": "H", + "name": "High", + "definition": "Mission Prevalence:Essential OR Public Well-Being Impact:(Irreversible)" + } + ] +} diff --git a/data/json/decision_points/ssvc/mission_impact_1_0_0.json b/data/json/decision_points/ssvc/mission_impact_1_0_0.json new file mode 100644 index 00000000..76f496f7 --- /dev/null +++ b/data/json/decision_points/ssvc/mission_impact_1_0_0.json @@ -0,0 +1,35 @@ +{ + "namespace": "ssvc", + "key": "MI", + "version": "1.0.0", + "name": "Mission Impact", + "definition": "Impact on Mission Essential Functions of the Organization", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "Little to no impact" + }, + { + "key": "NED", + "name": "Non-Essential Degraded", + "definition": "Degradation of non-essential functions; chronic degradation would eventually harm essential functions" + }, + { + "key": "MSC", + "name": "MEF Support Crippled", + "definition": "Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + { + "key": "MEF", + "name": "MEF Failure", + "definition": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + }, + { + "key": "MF", + "name": "Mission Failure", + "definition": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + } + ] +} diff --git a/data/json/decision_points/ssvc/mission_impact_2_0_0.json b/data/json/decision_points/ssvc/mission_impact_2_0_0.json new file mode 100644 index 00000000..3822302a --- /dev/null +++ b/data/json/decision_points/ssvc/mission_impact_2_0_0.json @@ -0,0 +1,30 @@ +{ + "namespace": "ssvc", + "key": "MI", + "version": "2.0.0", + "name": "Mission Impact", + "definition": "Impact on Mission Essential Functions of the Organization", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Degraded", + "definition": "Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions" + }, + { + "key": "MSC", + "name": "MEF Support Crippled", + "definition": "Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + { + "key": "MEF", + "name": "MEF Failure", + "definition": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + }, + { + "key": "MF", + "name": "Mission Failure", + "definition": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + } + ] +} diff --git a/data/json/decision_points/ssvc/public_safety_impact_2_0_0.json b/data/json/decision_points/ssvc/public_safety_impact_2_0_0.json new file mode 100644 index 00000000..2cfcf18c --- /dev/null +++ b/data/json/decision_points/ssvc/public_safety_impact_2_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.0", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:(None OR Minor)" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Major OR Hazardous OR Catastrophic)" + } + ] +} diff --git a/data/json/decision_points/public_safety_impact_2_0_1.json b/data/json/decision_points/ssvc/public_safety_impact_2_0_1.json similarity index 50% rename from data/json/decision_points/public_safety_impact_2_0_1.json rename to data/json/decision_points/ssvc/public_safety_impact_2_0_1.json index 7c60c4ef..a8e96eb6 100644 --- a/data/json/decision_points/public_safety_impact_2_0_1.json +++ b/data/json/decision_points/ssvc/public_safety_impact_2_0_1.json @@ -1,20 +1,20 @@ { - "name": "Public Safety Impact", - "description": "A coarse-grained representation of impact to public safety.", "namespace": "ssvc", - "version": "2.0.1", - "schemaVersion": "1-0-1", "key": "PSI", + "version": "2.0.1", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", "values": [ { "key": "M", "name": "Minimal", - "description": "Safety Impact:Negligible" + "definition": "Safety Impact:Negligible" }, { "key": "S", "name": "Significant", - "description": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" } ] } diff --git a/data/json/decision_points/ssvc/public_value_added_1_0_0.json b/data/json/decision_points/ssvc/public_value_added_1_0_0.json new file mode 100644 index 00000000..33759d6c --- /dev/null +++ b/data/json/decision_points/ssvc/public_value_added_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "PVA", + "version": "1.0.0", + "name": "Public Value Added", + "definition": "How much value would a publication from the coordinator benefit the broader community?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Limited", + "definition": "Minimal value added to the existing public information because existing information is already high quality and in multiple outlets." + }, + { + "key": "A", + "name": "Ampliative", + "definition": "Amplifies and/or augments the existing public information about the vulnerability, for example, adds additional detail, addresses or corrects errors in other public information, draws further attention to the vulnerability, etc." + }, + { + "key": "P", + "name": "Precedence", + "definition": "The publication would be the first publicly available, or be coincident with the first publicly available." + } + ] +} diff --git a/data/json/decision_points/ssvc/public_well_being_impact_1_1_0.json b/data/json/decision_points/ssvc/public_well_being_impact_1_1_0.json new file mode 100644 index 00000000..a441c6ff --- /dev/null +++ b/data/json/decision_points/ssvc/public_well_being_impact_1_1_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "PWI", + "version": "1.1.0", + "name": "Public Well-Being Impact", + "definition": "A coarse-grained representation of impact to public well-being.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "The effect is below the threshold for all aspects described in material. " + }, + { + "key": "MA", + "name": "Material", + "definition": "Any one or more of these conditions hold. Physical harm: Does one or more of the following: (a) Causes physical distress or injury to system users. (b) Introduces occupational safety hazards. (c) Reduces and/or results in failure of cyber-physical system safety margins. Environment: Major externalities (property damage, environmental damage, etc.) are imposed on other parties. Financial: Financial losses likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to necessitate counseling or therapy, impact populations of people. " + }, + { + "key": "I", + "name": "Irreversible", + "definition": "Any one or more of these conditions hold. Physical harm: One or both of the following are true: (a) Multiple fatalities are likely.(b) The cyber-physical system, of which the vulnerable componen is a part, is likely lost or destroyed. Environment: Extreme or serious externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) are imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software are destabilized and potentially collapse. Psychological: N/A " + } + ] +} diff --git a/data/json/decision_points/ssvc/publish_do_not_publish_1_0_0.json b/data/json/decision_points/ssvc/publish_do_not_publish_1_0_0.json new file mode 100644 index 00000000..eaad66ee --- /dev/null +++ b/data/json/decision_points/ssvc/publish_do_not_publish_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "PUBLISH", + "version": "1.0.0", + "name": "Publish, Do Not Publish", + "definition": "The publish outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Do Not Publish", + "definition": "Do Not Publish" + }, + { + "key": "P", + "name": "Publish", + "definition": "Publish" + } + ] +} diff --git a/data/json/decision_points/report_credibility_1_0_0.json b/data/json/decision_points/ssvc/report_credibility_1_0_0.json similarity index 57% rename from data/json/decision_points/report_credibility_1_0_0.json rename to data/json/decision_points/ssvc/report_credibility_1_0_0.json index 8cf756bd..ae5a793f 100644 --- a/data/json/decision_points/report_credibility_1_0_0.json +++ b/data/json/decision_points/ssvc/report_credibility_1_0_0.json @@ -1,20 +1,20 @@ { - "name": "Report Credibility", - "description": "Is the report credible?", "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", "key": "RC", + "version": "1.0.0", + "name": "Report Credibility", + "definition": "Is the report credible?", + "schemaVersion": "2.0.0", "values": [ { "key": "NC", "name": "Not Credible", - "description": "The report is not credible." + "definition": "The report is not credible." }, { "key": "C", "name": "Credible", - "description": "The report is credible." + "definition": "The report is credible." } ] } diff --git a/data/json/decision_points/ssvc/report_public_1_0_0.json b/data/json/decision_points/ssvc/report_public_1_0_0.json new file mode 100644 index 00000000..c859f165 --- /dev/null +++ b/data/json/decision_points/ssvc/report_public_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "RP", + "version": "1.0.0", + "name": "Report Public", + "definition": "Is a viable report of the details of the vulnerability already publicly available?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "Y", + "name": "Yes", + "definition": "A public report of the vulnerability exists." + }, + { + "key": "N", + "name": "No", + "definition": "No public report of the vulnerability exists." + } + ] +} diff --git a/data/json/decision_points/ssvc/safety_impact_1_0_0.json b/data/json/decision_points/ssvc/safety_impact_1_0_0.json new file mode 100644 index 00000000..264b75eb --- /dev/null +++ b/data/json/decision_points/ssvc/safety_impact_1_0_0.json @@ -0,0 +1,35 @@ +{ + "namespace": "ssvc", + "key": "SI", + "version": "1.0.0", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "The effect is below the threshold for all aspects described in Minor." + }, + { + "key": "M", + "name": "Minor", + "definition": "Any one or more of these conditions hold. Physical harm: Physical discomfort for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. System resiliency: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. Environment: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. Financial Financial losses, which are not readily absorbable, to multiple persons. Psychological: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "J", + "name": "Major", + "definition": "Any one or more of these conditions hold. Physical harm: Physical distress and injuries for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. System resiliency: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. Environment: Major externalities (property damage, environmental damage, etc.) imposed on other parties. Financial: Financial losses that likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "H", + "name": "Hazardous", + "definition": "Any one or more of these conditions hold. Physical harm: Serious or fatal injuries, where fatalities are plausibly preventable via emergency services or other measures. Operator resiliency: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. System resiliency: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. Environment: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. Financial: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. Psychological: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. Physical harm: Multiple immediate fatalities (Emergency response probably cannot save the victims.) Operator resiliency: Operator incapacitated (includes fatality or otherwise incapacitated). System resiliency: Total loss of whole cyber-physical system, of which the software is a part. Environment: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software collapse. Psychological: N/A." + } + ] +} diff --git a/data/json/decision_points/ssvc/safety_impact_2_0_0.json b/data/json/decision_points/ssvc/safety_impact_2_0_0.json new file mode 100644 index 00000000..dd224fae --- /dev/null +++ b/data/json/decision_points/ssvc/safety_impact_2_0_0.json @@ -0,0 +1,30 @@ +{ + "namespace": "ssvc", + "key": "SI", + "version": "2.0.0", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability. (based on IEC 61508)", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Minor injuries at worst (IEC 61508 Negligible).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard.
- *System resiliency*: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation.
- *Environment*: Minor externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses, which are not readily absorbable, to multiple persons.
- *Psychological*: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Major injuries to one or more persons (IEC 61508 Marginal).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard.
- *System resiliency*: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation.
- *Environment*: Major externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses that likely lead to bankruptcy of multiple persons.
- *Psychological*: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Loss of life (IEC 61508 Critical).
- *Operator resiliency*: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly.
- *System resiliency*: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact.
- *Environment*: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties.
- *Financial*: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state.
- *Psychological*: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Multiple loss of life (IEC 61508 Catastrophic).
- *Operator resiliency*: Operator incapacitated (includes fatality or otherwise incapacitated).
- *System resiliency*: Total loss of whole cyber-physical system, of which the software is a part.
- *Environment*: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties.
- *Financial*: Social systems (elections, financial grid, etc.) supported by the software collapse.
- *Psychological*: N/A." + } + ] +} diff --git a/data/json/decision_points/ssvc/safety_impact_2_0_1.json b/data/json/decision_points/ssvc/safety_impact_2_0_1.json new file mode 100644 index 00000000..67e8ed9f --- /dev/null +++ b/data/json/decision_points/ssvc/safety_impact_2_0_1.json @@ -0,0 +1,30 @@ +{ + "namespace": "ssvc", + "key": "SI", + "version": "2.0.1", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability. (based on IEC 61508 with modifications)", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold. **Physical harm**: Minor injuries at worst (IEC 61508 Negligible). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. **System resiliency**: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. **Environment**: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses, which are not readily absorbable, to multiple persons. **Psychological**: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold. **Physical harm**: Major injuries to one or more persons (IEC 61508 Marginal). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. **System resiliency**: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. **Environment**: Major externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses that likely lead to bankruptcy of multiple persons. **Psychological**: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold. **Physical harm**: Loss of life (IEC 61508 Critical). **Operator resiliency**: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. **System resiliency**: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. **Environment**: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. **Financial**: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. **Psychological**: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. **Physical harm**: Multiple loss of life (IEC 61508 Catastrophic). **Operator resiliency**: Operator incapacitated (includes fatality or otherwise incapacitated). **System resiliency**: Total loss of whole cyber-physical system, of which the software is a part. **Environment**: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. **Financial**: Social systems (elections, financial grid, etc.) supported by the software collapse. **Psychological**: N/A." + } + ] +} diff --git a/data/json/decision_points/ssvc/supplier_cardinality_1_0_0.json b/data/json/decision_points/ssvc/supplier_cardinality_1_0_0.json new file mode 100644 index 00000000..12ad6531 --- /dev/null +++ b/data/json/decision_points/ssvc/supplier_cardinality_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "SC", + "version": "1.0.0", + "name": "Supplier Cardinality", + "definition": "How many suppliers are responsible for the vulnerable component and its remediation or mitigation plan?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "O", + "name": "One", + "definition": "There is only one supplier of the vulnerable component." + }, + { + "key": "M", + "name": "Multiple", + "definition": "There are multiple suppliers of the vulnerable component." + } + ] +} diff --git a/data/json/decision_points/ssvc/supplier_contacted_1_0_0.json b/data/json/decision_points/ssvc/supplier_contacted_1_0_0.json new file mode 100644 index 00000000..e8a4698f --- /dev/null +++ b/data/json/decision_points/ssvc/supplier_contacted_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "SCON", + "version": "1.0.0", + "name": "Supplier Contacted", + "definition": "Has the reporter made a good-faith effort to contact the supplier of the vulnerable component using a quality contact method?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "The supplier has not been contacted." + }, + { + "key": "Y", + "name": "Yes", + "definition": "The supplier has been contacted." + } + ] +} diff --git a/data/json/decision_points/ssvc/supplier_engagement_1_0_0.json b/data/json/decision_points/ssvc/supplier_engagement_1_0_0.json new file mode 100644 index 00000000..29d45ac5 --- /dev/null +++ b/data/json/decision_points/ssvc/supplier_engagement_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "SE", + "version": "1.0.0", + "name": "Supplier Engagement", + "definition": "Is the supplier responding to the reporter’s contact effort and actively participating in the coordination effort?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "A", + "name": "Active", + "definition": "The supplier is responding to the reporter’s contact effort and actively participating in the coordination effort." + }, + { + "key": "U", + "name": "Unresponsive", + "definition": "The supplier is not responding to the reporter’s contact effort and not actively participating in the coordination effort." + } + ] +} diff --git a/data/json/decision_points/ssvc/supplier_involvement_1_0_0.json b/data/json/decision_points/ssvc/supplier_involvement_1_0_0.json new file mode 100644 index 00000000..eea94740 --- /dev/null +++ b/data/json/decision_points/ssvc/supplier_involvement_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "SINV", + "version": "1.0.0", + "name": "Supplier Involvement", + "definition": "What is the state of the supplier’s work on addressing the vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "FR", + "name": "Fix Ready", + "definition": "The supplier has provided a patch or fix." + }, + { + "key": "C", + "name": "Cooperative", + "definition": "The supplier is actively generating a patch or fix; they may or may not have provided a mitigation or work-around in the mean time." + }, + { + "key": "UU", + "name": "Uncooperative/Unresponsive", + "definition": "The supplier has not responded, declined to generate a remediation, or no longer exists." + } + ] +} diff --git a/data/json/decision_points/ssvc/system_exposure_1_0_0.json b/data/json/decision_points/ssvc/system_exposure_1_0_0.json new file mode 100644 index 00000000..f09137c0 --- /dev/null +++ b/data/json/decision_points/ssvc/system_exposure_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "EXP", + "version": "1.0.0", + "name": "System Exposure", + "definition": "The Accessible Attack Surface of the Affected System or Service", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "S", + "name": "Small", + "definition": "Local service or program; highly controlled network" + }, + { + "key": "C", + "name": "Controlled", + "definition": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + { + "key": "U", + "name": "Unavoidable", + "definition": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + ] +} diff --git a/data/json/decision_points/ssvc/system_exposure_1_0_1.json b/data/json/decision_points/ssvc/system_exposure_1_0_1.json new file mode 100644 index 00000000..0ee50eef --- /dev/null +++ b/data/json/decision_points/ssvc/system_exposure_1_0_1.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "EXP", + "version": "1.0.1", + "name": "System Exposure", + "definition": "The Accessible Attack Surface of the Affected System or Service", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "S", + "name": "Small", + "definition": "Local service or program; highly controlled network" + }, + { + "key": "C", + "name": "Controlled", + "definition": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + { + "key": "O", + "name": "Open", + "definition": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + ] +} diff --git a/data/json/decision_points/ssvc/technical_impact_1_0_0.json b/data/json/decision_points/ssvc/technical_impact_1_0_0.json new file mode 100644 index 00000000..25d7cb68 --- /dev/null +++ b/data/json/decision_points/ssvc/technical_impact_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "TI", + "version": "1.0.0", + "name": "Technical Impact", + "definition": "The technical impact of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Partial", + "definition": "The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control." + }, + { + "key": "T", + "name": "Total", + "definition": "The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability." + } + ] +} diff --git a/data/json/decision_points/ssvc/utility_1_0_0.json b/data/json/decision_points/ssvc/utility_1_0_0.json new file mode 100644 index 00000000..bbdcc41b --- /dev/null +++ b/data/json/decision_points/ssvc/utility_1_0_0.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "U", + "version": "1.0.0", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Virulence:Slow and Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "Virulence:Rapid and Value Density:Diffuse OR Virulence:Slow and Value Density:Concentrated" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Virulence:Rapid and Value Density:Concentrated" + } + ] +} diff --git a/data/json/decision_points/ssvc/utility_1_0_1.json b/data/json/decision_points/ssvc/utility_1_0_1.json new file mode 100644 index 00000000..33d3c787 --- /dev/null +++ b/data/json/decision_points/ssvc/utility_1_0_1.json @@ -0,0 +1,25 @@ +{ + "namespace": "ssvc", + "key": "U", + "version": "1.0.1", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + ] +} diff --git a/data/json/decision_points/ssvc/value_density_1_0_0.json b/data/json/decision_points/ssvc/value_density_1_0_0.json new file mode 100644 index 00000000..1d2e7eb3 --- /dev/null +++ b/data/json/decision_points/ssvc/value_density_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "VD", + "version": "1.0.0", + "name": "Value Density", + "definition": "The concentration of value in the target", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Diffuse", + "definition": "The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small." + }, + { + "key": "C", + "name": "Concentrated", + "definition": "The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users." + } + ] +} diff --git a/data/json/decision_points/ssvc/virulence_1_0_0.json b/data/json/decision_points/ssvc/virulence_1_0_0.json new file mode 100644 index 00000000..055ca76b --- /dev/null +++ b/data/json/decision_points/ssvc/virulence_1_0_0.json @@ -0,0 +1,20 @@ +{ + "namespace": "ssvc", + "key": "V", + "version": "1.0.0", + "name": "Virulence", + "definition": "The speed at which the vulnerability can be exploited.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "S", + "name": "Slow", + "definition": "Steps 1-4 of the kill chain cannot be reliably automated for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation." + }, + { + "key": "R", + "name": "Rapid", + "definition": "Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows remote code execution or command injection, the default response should be rapid." + } + ] +} diff --git a/data/json/decision_points/supplier_cardinality_1_0_0.json b/data/json/decision_points/supplier_cardinality_1_0_0.json deleted file mode 100644 index ec1df5a8..00000000 --- a/data/json/decision_points/supplier_cardinality_1_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Supplier Cardinality", - "description": "How many suppliers are responsible for the vulnerable component and its remediation or mitigation plan?", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "SC", - "values": [ - { - "key": "O", - "name": "One", - "description": "There is only one supplier of the vulnerable component." - }, - { - "key": "M", - "name": "Multiple", - "description": "There are multiple suppliers of the vulnerable component." - } - ] -} diff --git a/data/json/decision_points/supplier_contacted_1_0_0.json b/data/json/decision_points/supplier_contacted_1_0_0.json deleted file mode 100644 index c32d5755..00000000 --- a/data/json/decision_points/supplier_contacted_1_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Supplier Contacted", - "description": "Has the reporter made a good-faith effort to contact the supplier of the vulnerable component using a quality contact method?", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "SC", - "values": [ - { - "key": "N", - "name": "No", - "description": "The supplier has not been contacted." - }, - { - "key": "Y", - "name": "Yes", - "description": "The supplier has been contacted." - } - ] -} diff --git a/data/json/decision_points/supplier_engagement_1_0_0.json b/data/json/decision_points/supplier_engagement_1_0_0.json deleted file mode 100644 index d9f704b0..00000000 --- a/data/json/decision_points/supplier_engagement_1_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Supplier Engagement", - "description": "Is the supplier responding to the reporter’s contact effort and actively participating in the coordination effort?", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "SE", - "values": [ - { - "key": "A", - "name": "Active", - "description": "The supplier is responding to the reporter’s contact effort and actively participating in the coordination effort." - }, - { - "key": "U", - "name": "Unresponsive", - "description": "The supplier is not responding to the reporter’s contact effort and not actively participating in the coordination effort." - } - ] -} diff --git a/data/json/decision_points/supplier_involvement_1_0_0.json b/data/json/decision_points/supplier_involvement_1_0_0.json deleted file mode 100644 index 15d014e5..00000000 --- a/data/json/decision_points/supplier_involvement_1_0_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "Supplier Involvement", - "description": "What is the state of the supplier’s work on addressing the vulnerability?", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "SI", - "values": [ - { - "key": "FR", - "name": "Fix Ready", - "description": "The supplier has provided a patch or fix." - }, - { - "key": "C", - "name": "Cooperative", - "description": "The supplier is actively generating a patch or fix; they may or may not have provided a mitigation or work-around in the mean time." - }, - { - "key": "UU", - "name": "Uncooperative/Unresponsive", - "description": "The supplier has not responded, declined to generate a remediation, or no longer exists." - } - ] -} diff --git a/data/json/decision_points/system_exposure_1_0_0.json b/data/json/decision_points/system_exposure_1_0_0.json deleted file mode 100644 index c72411b5..00000000 --- a/data/json/decision_points/system_exposure_1_0_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "System Exposure", - "description": "The Accessible Attack Surface of the Affected System or Service", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "EXP", - "values": [ - { - "key": "S", - "name": "Small", - "description": "Local service or program; highly controlled network" - }, - { - "key": "C", - "name": "Controlled", - "description": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." - }, - { - "key": "U", - "name": "Unavoidable", - "description": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" - } - ] -} diff --git a/data/json/decision_points/system_exposure_1_0_1.json b/data/json/decision_points/system_exposure_1_0_1.json deleted file mode 100644 index 4babf60e..00000000 --- a/data/json/decision_points/system_exposure_1_0_1.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "System Exposure", - "description": "The Accessible Attack Surface of the Affected System or Service", - "namespace": "ssvc", - "version": "1.0.1", - "schemaVersion": "1-0-1", - "key": "EXP", - "values": [ - { - "key": "S", - "name": "Small", - "description": "Local service or program; highly controlled network" - }, - { - "key": "C", - "name": "Controlled", - "description": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." - }, - { - "key": "O", - "name": "Open", - "description": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" - } - ] -} diff --git a/data/json/decision_points/technical_impact_1_0_0.json b/data/json/decision_points/technical_impact_1_0_0.json deleted file mode 100644 index 92ecdb4e..00000000 --- a/data/json/decision_points/technical_impact_1_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Technical Impact", - "description": "The technical impact of the vulnerability.", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "TI", - "values": [ - { - "key": "P", - "name": "Partial", - "description": "The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control." - }, - { - "key": "T", - "name": "Total", - "description": "The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability." - } - ] -} diff --git a/data/json/decision_points/utility_1_0_0.json b/data/json/decision_points/utility_1_0_0.json deleted file mode 100644 index 71d0ca5f..00000000 --- a/data/json/decision_points/utility_1_0_0.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "Utility", - "description": "The Usefulness of the Exploit to the Adversary", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "U", - "values": [ - { - "key": "L", - "name": "Laborious", - "description": "Virulence:Slow and Value Density:Diffuse" - }, - { - "key": "E", - "name": "Efficient", - "description": "Virulence:Rapid and Value Density:Diffuse OR Virulence:Slow and Value Density:Concentrated" - }, - { - "key": "S", - "name": "Super Effective", - "description": "Virulence:Rapid and Value Density:Concentrated" - } - ] -} diff --git a/data/json/decision_points/utility_1_0_1.json b/data/json/decision_points/utility_1_0_1.json deleted file mode 100644 index 5c22b7fe..00000000 --- a/data/json/decision_points/utility_1_0_1.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "name": "Utility", - "description": "The Usefulness of the Exploit to the Adversary", - "namespace": "ssvc", - "version": "1.0.1", - "schemaVersion": "1-0-1", - "key": "U", - "values": [ - { - "key": "L", - "name": "Laborious", - "description": "Automatable:No AND Value Density:Diffuse" - }, - { - "key": "E", - "name": "Efficient", - "description": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" - }, - { - "key": "S", - "name": "Super Effective", - "description": "Automatable:Yes AND Value Density:Concentrated" - } - ] -} diff --git a/data/json/decision_points/value_density_1_0_0.json b/data/json/decision_points/value_density_1_0_0.json deleted file mode 100644 index 4658a012..00000000 --- a/data/json/decision_points/value_density_1_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Value Density", - "description": "The concentration of value in the target", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "VD", - "values": [ - { - "key": "D", - "name": "Diffuse", - "description": "The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small." - }, - { - "key": "C", - "name": "Concentrated", - "description": "The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users." - } - ] -} diff --git a/data/json/decision_points/virulence_1_0_0.json b/data/json/decision_points/virulence_1_0_0.json deleted file mode 100644 index b08d9539..00000000 --- a/data/json/decision_points/virulence_1_0_0.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "name": "Virulence", - "description": "The speed at which the vulnerability can be exploited.", - "namespace": "ssvc", - "version": "1.0.0", - "schemaVersion": "1-0-1", - "key": "V", - "values": [ - { - "key": "S", - "name": "Slow", - "description": "Steps 1-4 of the kill chain cannot be reliably automated for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation." - }, - { - "key": "R", - "name": "Rapid", - "description": "Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows remote code execution or command injection, the default response should be rapid." - } - ] -} diff --git a/data/json/outcomes/THE_PARANOIDS.json b/data/json/decision_points/x_com_yahooinc_prioritized_risk_remediation/theparanoids_1_0_0.json similarity index 50% rename from data/json/outcomes/THE_PARANOIDS.json rename to data/json/decision_points/x_com_yahooinc_prioritized_risk_remediation/theparanoids_1_0_0.json index f19fb83d..d5cad0b8 100644 --- a/data/json/outcomes/THE_PARANOIDS.json +++ b/data/json/decision_points/x_com_yahooinc_prioritized_risk_remediation/theparanoids_1_0_0.json @@ -1,38 +1,40 @@ { + "namespace": "x_com.yahooinc#prioritized-risk-remediation", + "key": "PARANOIDS", "version": "1.0.0", - "schemaVersion": "1-0-1", "name": "theParanoids", - "description": "PrioritizedRiskRemediation outcome group based on TheParanoids.", - "outcomes": [ + "definition": "PrioritizedRiskRemediation outcome group based on TheParanoids.", + "schemaVersion": "2.0.0", + "values": [ { "key": "5", "name": "Track 5", - "description": "Track" + "definition": "Track" }, { "key": "4", "name": "Track Closely 4", - "description": "Track Closely" + "definition": "Track Closely" }, { "key": "3", "name": "Attend 3", - "description": "Attend" + "definition": "Attend" }, { "key": "2", "name": "Attend 2", - "description": "Attend" + "definition": "Attend" }, { "key": "1", "name": "Act 1", - "description": "Act" + "definition": "Act" }, { "key": "0", "name": "Act ASAP 0", - "description": "Act ASAP" + "definition": "Act ASAP" } ] -} \ No newline at end of file +} diff --git a/data/json/decision_tables/cisa/cisa_coordinator_2_0_3.json b/data/json/decision_tables/cisa/cisa_coordinator_2_0_3.json new file mode 100644 index 00000000..2a076a2c --- /dev/null +++ b/data/json/decision_tables/cisa/cisa_coordinator_2_0_3.json @@ -0,0 +1,385 @@ +{ + "namespace": "cisa", + "key": "DT_CO", + "version": "2.0.3", + "name": "CISA Coordinator", + "definition": "CISA Coordinator decision table for SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:E:1.1.0": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "ssvc:A:2.0.0": { + "namespace": "ssvc", + "key": "A", + "version": "2.0.0", + "name": "Automatable", + "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + ] + }, + "ssvc:TI:1.0.0": { + "namespace": "ssvc", + "key": "TI", + "version": "1.0.0", + "name": "Technical Impact", + "definition": "The technical impact of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Partial", + "definition": "The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control." + }, + { + "key": "T", + "name": "Total", + "definition": "The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability." + } + ] + }, + "ssvc:MWI:1.0.0": { + "namespace": "ssvc", + "key": "MWI", + "version": "1.0.0", + "name": "Mission and Well-Being Impact", + "definition": "Mission and Well-Being Impact is a combination of Mission Prevalence and Public Well-Being Impact.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Mission Prevalence:Minimal AND Public Well-Being Impact:Minimal" + }, + { + "key": "M", + "name": "Medium", + "definition": "Mission Prevalence:Support AND Public Well-Being Impact:(Minimal OR Material)" + }, + { + "key": "H", + "name": "High", + "definition": "Mission Prevalence:Essential OR Public Well-Being Impact:(Irreversible)" + } + ] + }, + "cisa:CISA:1.1.0": { + "namespace": "cisa", + "key": "CISA", + "version": "1.1.0", + "name": "CISA Levels", + "definition": "The CISA outcome group. CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Track*, Attend, and Act.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "T", + "name": "Track", + "definition": "The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines." + }, + { + "key": "T*", + "name": "Track*", + "definition": "The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines." + }, + { + "key": "AT", + "name": "Attend", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines." + }, + { + "key": "AC", + "name": "Act", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible." + } + ] + } + }, + "outcome": "cisa:CISA:1.1.0", + "mapping": [ + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "T*" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "T*" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T*" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T*" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AC" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AC" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "AC" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AC" + } + ] +} diff --git a/data/json/decision_tables/cvss/cvss_v4_0_qualitative_severity_ratings_4_0_0.json b/data/json/decision_tables/cvss/cvss_v4_0_qualitative_severity_ratings_4_0_0.json new file mode 100644 index 00000000..fd5a7f1b --- /dev/null +++ b/data/json/decision_tables/cvss/cvss_v4_0_qualitative_severity_ratings_4_0_0.json @@ -0,0 +1,3104 @@ +{ + "namespace": "cvss", + "key": "DT_CVSS_QSR", + "version": "4.0.0", + "name": "CVSS v4.0 Qualitative Severity Ratings", + "definition": "CVSS v4.0 using MacroVectors and Interpolation. See https://www.first.org/cvss/specification-document#New-Scoring-System-Development for details", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:EQ1:1.0.0": { + "namespace": "cvss", + "key": "EQ1", + "version": "1.0.0", + "name": "Equivalence Set 1", + "definition": "AV/PR/UI with 3 levels specified in Table 24", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: AV:P or not(AV:N or PR:N or UI:N)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: AV:N and PR:N and UI:N" + } + ] + }, + "cvss:EQ2:1.0.0": { + "namespace": "cvss", + "key": "EQ2", + "version": "1.0.0", + "name": "Equivalence Set 2", + "definition": "AC/AT with 2 levels specified in Table 25", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (AC:L and AT:N)" + }, + { + "key": "H", + "name": "High", + "definition": "0: AC:L and AT:N" + } + ] + }, + "cvss:EQ3:1.0.0": { + "namespace": "cvss", + "key": "EQ3", + "version": "1.0.0", + "name": "Equivalence Set 3", + "definition": "VC/VI/VA with 3 levels specified in Table 26", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (VC:H or VI:H or VA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: VC:H and VI:H" + } + ] + }, + "cvss:EQ4:1.0.0": { + "namespace": "cvss", + "key": "EQ4", + "version": "1.0.0", + "name": "Equivalence Set 4", + "definition": "SC/SI/SA with 3 levels specified in Table 27", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: MSI:S or MSA:S" + } + ] + }, + "cvss:EQ5:1.0.0": { + "namespace": "cvss", + "key": "EQ5", + "version": "1.0.0", + "name": "Equivalence Set 5", + "definition": "E with 3 levels specified in Table 28", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: E:U" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: E:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: E:A" + } + ] + }, + "cvss:EQ6:1.0.0": { + "namespace": "cvss", + "key": "EQ6", + "version": "1.0.0", + "name": "Equivalence Set 6", + "definition": "VC/VI/VA+CR/CI/CA with 2 levels specified in Table 29", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)" + } + ] + }, + "cvss:CVSS:1.0.0": { + "namespace": "cvss", + "key": "CVSS", + "version": "1.0.0", + "name": "CVSS Qualitative Severity Rating Scale", + "definition": "The CVSS Qualitative Severity Rating Scale group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "None (0.0)" + }, + { + "key": "L", + "name": "Low", + "definition": "Low (0.1-3.9)" + }, + { + "key": "M", + "name": "Medium", + "definition": "Medium (4.0-6.9)" + }, + { + "key": "H", + "name": "High", + "definition": "High (7.0-8.9)" + }, + { + "key": "C", + "name": "Critical", + "definition": "Critical (9.0-10.0)" + } + ] + } + }, + "outcome": "cvss:CVSS:1.0.0", + "mapping": [ + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + } + ] +} diff --git a/data/json/decision_tables/cvss/cvss_v4_equivalence_set_1_1_0_0.json b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_1_1_0_0.json new file mode 100644 index 00000000..97711ae8 --- /dev/null +++ b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_1_1_0_0.json @@ -0,0 +1,334 @@ +{ + "namespace": "cvss", + "key": "DT_CVSS4_EQ1", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 1", + "definition": "This decision table models equivalence set 1 from CVSS v4. Factors include Attack Vector (AV), Privileges Required (PR), and User Interaction (UI).", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:AV:3.0.1": { + "namespace": "cvss", + "key": "AV", + "version": "3.0.1", + "name": "Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Physical", + "definition": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." + }, + { + "key": "L", + "name": "Local", + "definition": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." + }, + { + "key": "A", + "name": "Adjacent", + "definition": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." + }, + { + "key": "N", + "name": "Network", + "definition": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." + } + ] + }, + "cvss:PR:1.0.1": { + "namespace": "cvss", + "key": "PR", + "version": "1.0.1", + "name": "Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." + }, + { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + } + ] + }, + "cvss:UI:2.0.0": { + "namespace": "cvss", + "key": "UI", + "version": "2.0.0", + "name": "User Interaction", + "definition": "This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "A", + "name": "Active", + "definition": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." + }, + { + "key": "P", + "name": "Passive", + "definition": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." + }, + { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." + } + ] + }, + "cvss:EQ1:1.0.0": { + "namespace": "cvss", + "key": "EQ1", + "version": "1.0.0", + "name": "Equivalence Set 1", + "definition": "AV/PR/UI with 3 levels specified in Table 24", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: AV:P or not(AV:N or PR:N or UI:N)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: AV:N and PR:N and UI:N" + } + ] + } + }, + "outcome": "cvss:EQ1:1.0.0", + "mapping": [ + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "H" + } + ] +} diff --git a/data/json/decision_tables/cvss/cvss_v4_equivalence_set_2_1_0_0.json b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_2_1_0_0.json new file mode 100644 index 00000000..1bee90bf --- /dev/null +++ b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_2_1_0_0.json @@ -0,0 +1,93 @@ +{ + "namespace": "cvss", + "key": "DT_CVSS4_EQ2", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 2", + "definition": "This decision table models equivalence set 2 from CVSS v4. Factors include Attack Complexity (AC) and Attack Requirements (AT).", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:AC:3.0.1": { + "namespace": "cvss", + "key": "AC", + "version": "3.0.1", + "name": "Attack Complexity", + "definition": "This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. ", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " + } + ] + }, + "cvss:AT:1.0.0": { + "namespace": "cvss", + "key": "AT", + "version": "1.0.0", + "name": "Attack Requirements", + "definition": "This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Present", + "definition": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + }, + { + "key": "N", + "name": "None", + "definition": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." + } + ] + }, + "cvss:EQ2:1.0.0": { + "namespace": "cvss", + "key": "EQ2", + "version": "1.0.0", + "name": "Equivalence Set 2", + "definition": "AC/AT with 2 levels specified in Table 25", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (AC:L and AT:N)" + }, + { + "key": "H", + "name": "High", + "definition": "0: AC:L and AT:N" + } + ] + } + }, + "outcome": "cvss:EQ2:1.0.0", + "mapping": [ + { + "cvss:AC:3.0.1": "H", + "cvss:AT:1.0.0": "P", + "cvss:EQ2:1.0.0": "L" + }, + { + "cvss:AC:3.0.1": "L", + "cvss:AT:1.0.0": "P", + "cvss:EQ2:1.0.0": "L" + }, + { + "cvss:AC:3.0.1": "H", + "cvss:AT:1.0.0": "N", + "cvss:EQ2:1.0.0": "L" + }, + { + "cvss:AC:3.0.1": "L", + "cvss:AT:1.0.0": "N", + "cvss:EQ2:1.0.0": "H" + } + ] +} diff --git a/data/json/decision_tables/cvss/cvss_v4_equivalence_set_3_1_0_0.json b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_3_1_0_0.json new file mode 100644 index 00000000..dd5c4502 --- /dev/null +++ b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_3_1_0_0.json @@ -0,0 +1,275 @@ +{ + "namespace": "cvss", + "key": "DT_CVSS4_EQ3", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 3", + "definition": "This decision table models equivalence set 3 from CVSS v4.", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:VC:3.0.0": { + "namespace": "cvss", + "key": "VC", + "version": "3.0.0", + "name": "Confidentiality Impact to the Vulnerable System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + } + ] + }, + "cvss:VI:3.0.0": { + "namespace": "cvss", + "key": "VI", + "version": "3.0.0", + "name": "Integrity Impact to the Vulnerable System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + } + ] + }, + "cvss:VA:3.0.0": { + "namespace": "cvss", + "key": "VA", + "version": "3.0.0", + "name": "Availability Impact to the Vulnerable System", + "definition": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + ] + }, + "cvss:EQ3:1.0.0": { + "namespace": "cvss", + "key": "EQ3", + "version": "1.0.0", + "name": "Equivalence Set 3", + "definition": "VC/VI/VA with 3 levels specified in Table 26", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (VC:H or VI:H or VA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: VC:H and VI:H" + } + ] + } + }, + "outcome": "cvss:EQ3:1.0.0", + "mapping": [ + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "H" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "H" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "H" + } + ] +} diff --git a/data/json/decision_tables/cvss/cvss_v4_equivalence_set_4_1_0_0.json b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_4_1_0_0.json new file mode 100644 index 00000000..6e587adf --- /dev/null +++ b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_4_1_0_0.json @@ -0,0 +1,411 @@ +{ + "namespace": "cvss", + "key": "DT_CVSS4_EQ4", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 4", + "definition": "This decision table models equivalence set 4 from CVSS v4.", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:SC:1.0.0": { + "namespace": "cvss", + "key": "SC", + "version": "1.0.0", + "name": "Confidentiality Impact to the Subsequent System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + } + ] + }, + "cvss:MSI_NoX:1.0.1": { + "namespace": "cvss", + "key": "MSI_NoX", + "version": "1.0.1", + "name": "Modified Integrity Impact to the Subsequent System (without Not Defined)", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] + }, + "cvss:MSA_NoX:1.0.1": { + "namespace": "cvss", + "key": "MSA_NoX", + "version": "1.0.1", + "name": "Modified Availability Impact to the Subsequent System (without Not Defined)", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] + }, + "cvss:EQ4:1.0.0": { + "namespace": "cvss", + "key": "EQ4", + "version": "1.0.0", + "name": "Equivalence Set 4", + "definition": "SC/SI/SA with 3 levels specified in Table 27", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: MSI:S or MSA:S" + } + ] + } + }, + "outcome": "cvss:EQ4:1.0.0", + "mapping": [ + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + } + ] +} diff --git a/data/json/decision_tables/cvss/cvss_v4_equivalence_set_5_1_0_0.json b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_5_1_0_0.json new file mode 100644 index 00000000..12c737db --- /dev/null +++ b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_5_1_0_0.json @@ -0,0 +1,75 @@ +{ + "namespace": "cvss", + "key": "DT_CVSS_EQ5", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 5", + "definition": "CVSS Equivalence Set 5 Decision Table", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:E_NoX:2.0.0": { + "namespace": "cvss", + "key": "E_NoX", + "version": "2.0.0", + "name": "Exploit Maturity (without Not Defined)", + "definition": "This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unreported", + "definition": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" + }, + { + "key": "P", + "name": "Proof-of-Concept", + "definition": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" + }, + { + "key": "A", + "name": "Attacked", + "definition": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" + } + ] + }, + "cvss:EQ5:1.0.0": { + "namespace": "cvss", + "key": "EQ5", + "version": "1.0.0", + "name": "Equivalence Set 5", + "definition": "E with 3 levels specified in Table 28", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: E:U" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: E:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: E:A" + } + ] + } + }, + "outcome": "cvss:EQ5:1.0.0", + "mapping": [ + { + "cvss:E_NoX:2.0.0": "U", + "cvss:EQ5:1.0.0": "L" + }, + { + "cvss:E_NoX:2.0.0": "P", + "cvss:EQ5:1.0.0": "M" + }, + { + "cvss:E_NoX:2.0.0": "A", + "cvss:EQ5:1.0.0": "H" + } + ] +} diff --git a/data/json/decision_tables/cvss/cvss_v4_equivalence_set_6_1_0_0.json b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_6_1_0_0.json new file mode 100644 index 00000000..887ff00a --- /dev/null +++ b/data/json/decision_tables/cvss/cvss_v4_equivalence_set_6_1_0_0.json @@ -0,0 +1,6744 @@ +{ + "namespace": "cvss", + "key": "DT_CVSS4_EQ6", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 6", + "definition": "This decision table models equivalence set 6 from CVSS v4.", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:CR_NoX:1.1.1": { + "namespace": "cvss", + "key": "CR_NoX", + "version": "1.1.1", + "name": "Confidentiality Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "cvss:VC:3.0.0": { + "namespace": "cvss", + "key": "VC", + "version": "3.0.0", + "name": "Confidentiality Impact to the Vulnerable System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + } + ] + }, + "cvss:IR_NoX:1.1.1": { + "namespace": "cvss", + "key": "IR_NoX", + "version": "1.1.1", + "name": "Integrity Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "cvss:VI:3.0.0": { + "namespace": "cvss", + "key": "VI", + "version": "3.0.0", + "name": "Integrity Impact to the Vulnerable System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + } + ] + }, + "cvss:AR_NoX:1.1.1": { + "namespace": "cvss", + "key": "AR_NoX", + "version": "1.1.1", + "name": "Availability Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Availability. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "cvss:VA:3.0.0": { + "namespace": "cvss", + "key": "VA", + "version": "3.0.0", + "name": "Availability Impact to the Vulnerable System", + "definition": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + ] + }, + "cvss:EQ6:1.0.0": { + "namespace": "cvss", + "key": "EQ6", + "version": "1.0.0", + "name": "Equivalence Set 6", + "definition": "VC/VI/VA+CR/CI/CA with 2 levels specified in Table 29", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)" + } + ] + } + }, + "outcome": "cvss:EQ6:1.0.0", + "mapping": [ + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + } + ] +} diff --git a/data/json/decision_tables/ssvc/coordinator_publish_decision_table_1_0_0.json b/data/json/decision_tables/ssvc/coordinator_publish_decision_table_1_0_0.json new file mode 100644 index 00000000..6d478ced --- /dev/null +++ b/data/json/decision_tables/ssvc/coordinator_publish_decision_table_1_0_0.json @@ -0,0 +1,270 @@ +{ + "namespace": "ssvc", + "key": "DT_COORD_PUBLISH", + "version": "1.0.0", + "name": "Coordinator Publish Decision Table", + "definition": "This decision table is used to determine the priority of a coordinator publish.", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:SINV:1.0.0": { + "namespace": "ssvc", + "key": "SINV", + "version": "1.0.0", + "name": "Supplier Involvement", + "definition": "What is the state of the supplier’s work on addressing the vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "FR", + "name": "Fix Ready", + "definition": "The supplier has provided a patch or fix." + }, + { + "key": "C", + "name": "Cooperative", + "definition": "The supplier is actively generating a patch or fix; they may or may not have provided a mitigation or work-around in the mean time." + }, + { + "key": "UU", + "name": "Uncooperative/Unresponsive", + "definition": "The supplier has not responded, declined to generate a remediation, or no longer exists." + } + ] + }, + "ssvc:E:1.1.0": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "ssvc:PVA:1.0.0": { + "namespace": "ssvc", + "key": "PVA", + "version": "1.0.0", + "name": "Public Value Added", + "definition": "How much value would a publication from the coordinator benefit the broader community?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Limited", + "definition": "Minimal value added to the existing public information because existing information is already high quality and in multiple outlets." + }, + { + "key": "A", + "name": "Ampliative", + "definition": "Amplifies and/or augments the existing public information about the vulnerability, for example, adds additional detail, addresses or corrects errors in other public information, draws further attention to the vulnerability, etc." + }, + { + "key": "P", + "name": "Precedence", + "definition": "The publication would be the first publicly available, or be coincident with the first publicly available." + } + ] + }, + "ssvc:PUBLISH:1.0.0": { + "namespace": "ssvc", + "key": "PUBLISH", + "version": "1.0.0", + "name": "Publish, Do Not Publish", + "definition": "The publish outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Do Not Publish", + "definition": "Do Not Publish" + }, + { + "key": "P", + "name": "Publish", + "definition": "Publish" + } + ] + } + }, + "outcome": "ssvc:PUBLISH:1.0.0", + "mapping": [ + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + } + ] +} diff --git a/data/json/decision_tables/ssvc/coordinator_triage_1_0_0.json b/data/json/decision_tables/ssvc/coordinator_triage_1_0_0.json new file mode 100644 index 00000000..ca54f544 --- /dev/null +++ b/data/json/decision_tables/ssvc/coordinator_triage_1_0_0.json @@ -0,0 +1,2103 @@ +{ + "namespace": "ssvc", + "key": "DT_COORD_TRIAGE", + "version": "1.0.0", + "name": "Coordinator Triage", + "definition": "Decision table for coordinator triage", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:RP:1.0.0": { + "namespace": "ssvc", + "key": "RP", + "version": "1.0.0", + "name": "Report Public", + "definition": "Is a viable report of the details of the vulnerability already publicly available?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "Y", + "name": "Yes", + "definition": "A public report of the vulnerability exists." + }, + { + "key": "N", + "name": "No", + "definition": "No public report of the vulnerability exists." + } + ] + }, + "ssvc:SCON:1.0.0": { + "namespace": "ssvc", + "key": "SCON", + "version": "1.0.0", + "name": "Supplier Contacted", + "definition": "Has the reporter made a good-faith effort to contact the supplier of the vulnerable component using a quality contact method?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "The supplier has not been contacted." + }, + { + "key": "Y", + "name": "Yes", + "definition": "The supplier has been contacted." + } + ] + }, + "ssvc:RC:1.0.0": { + "namespace": "ssvc", + "key": "RC", + "version": "1.0.0", + "name": "Report Credibility", + "definition": "Is the report credible?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "NC", + "name": "Not Credible", + "definition": "The report is not credible." + }, + { + "key": "C", + "name": "Credible", + "definition": "The report is credible." + } + ] + }, + "ssvc:SC:1.0.0": { + "namespace": "ssvc", + "key": "SC", + "version": "1.0.0", + "name": "Supplier Cardinality", + "definition": "How many suppliers are responsible for the vulnerable component and its remediation or mitigation plan?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "O", + "name": "One", + "definition": "There is only one supplier of the vulnerable component." + }, + { + "key": "M", + "name": "Multiple", + "definition": "There are multiple suppliers of the vulnerable component." + } + ] + }, + "ssvc:SE:1.0.0": { + "namespace": "ssvc", + "key": "SE", + "version": "1.0.0", + "name": "Supplier Engagement", + "definition": "Is the supplier responding to the reporter’s contact effort and actively participating in the coordination effort?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "A", + "name": "Active", + "definition": "The supplier is responding to the reporter’s contact effort and actively participating in the coordination effort." + }, + { + "key": "U", + "name": "Unresponsive", + "definition": "The supplier is not responding to the reporter’s contact effort and not actively participating in the coordination effort." + } + ] + }, + "ssvc:U:1.0.1": { + "namespace": "ssvc", + "key": "U", + "version": "1.0.1", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + ] + }, + "ssvc:PSI:2.0.1": { + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.1", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:Negligible" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + } + ] + }, + "ssvc:COORDINATE:1.0.1": { + "namespace": "ssvc", + "key": "COORDINATE", + "version": "1.0.1", + "name": "Decline, Track, Coordinate", + "definition": "The coordinate outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Decline", + "definition": "Do not act on the report." + }, + { + "key": "T", + "name": "Track", + "definition": "Receive information about the vulnerability and monitor for status changes but do not take any overt actions." + }, + { + "key": "C", + "name": "Coordinate", + "definition": "Take action on the report." + } + ] + } + }, + "outcome": "ssvc:COORDINATE:1.0.1", + "mapping": [ + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + } + ] +} diff --git a/data/json/decision_tables/ssvc/deployer_patch_application_priority_1_0_0.json b/data/json/decision_tables/ssvc/deployer_patch_application_priority_1_0_0.json new file mode 100644 index 00000000..db82509f --- /dev/null +++ b/data/json/decision_tables/ssvc/deployer_patch_application_priority_1_0_0.json @@ -0,0 +1,647 @@ +{ + "namespace": "ssvc", + "key": "DT_DP", + "version": "1.0.0", + "name": "Deployer Patch Application Priority", + "definition": "Decision table for evaluating deployer's patch application priority in SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:E:1.1.0": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "ssvc:EXP:1.0.1": { + "namespace": "ssvc", + "key": "EXP", + "version": "1.0.1", + "name": "System Exposure", + "definition": "The Accessible Attack Surface of the Affected System or Service", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "S", + "name": "Small", + "definition": "Local service or program; highly controlled network" + }, + { + "key": "C", + "name": "Controlled", + "definition": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + { + "key": "O", + "name": "Open", + "definition": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + ] + }, + "ssvc:A:2.0.0": { + "namespace": "ssvc", + "key": "A", + "version": "2.0.0", + "name": "Automatable", + "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + ] + }, + "ssvc:HI:2.0.2": { + "namespace": "ssvc", + "key": "HI", + "version": "2.0.2", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] + }, + "ssvc:DSOI:1.0.0": { + "namespace": "ssvc", + "key": "DSOI", + "version": "1.0.0", + "name": "Defer, Scheduled, Out-of-Cycle, Immediate", + "definition": "The original SSVC outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Defer", + "definition": "Defer" + }, + { + "key": "S", + "name": "Scheduled", + "definition": "Scheduled" + }, + { + "key": "O", + "name": "Out-of-Cycle", + "definition": "Out-of-Cycle" + }, + { + "key": "I", + "name": "Immediate", + "definition": "Immediate" + } + ] + } + }, + "outcome": "ssvc:DSOI:1.0.0", + "mapping": [ + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "I" + } + ] +} diff --git a/data/json/decision_tables/ssvc/human_impact_1_0_0.json b/data/json/decision_tables/ssvc/human_impact_1_0_0.json new file mode 100644 index 00000000..3bab08a2 --- /dev/null +++ b/data/json/decision_tables/ssvc/human_impact_1_0_0.json @@ -0,0 +1,183 @@ +{ + "namespace": "ssvc", + "key": "DT_HI", + "version": "1.0.0", + "name": "Human Impact", + "definition": "Human Impact decision table for SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:SI:2.0.1": { + "namespace": "ssvc", + "key": "SI", + "version": "2.0.1", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability. (based on IEC 61508 with modifications)", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold. **Physical harm**: Minor injuries at worst (IEC 61508 Negligible). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. **System resiliency**: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. **Environment**: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses, which are not readily absorbable, to multiple persons. **Psychological**: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold. **Physical harm**: Major injuries to one or more persons (IEC 61508 Marginal). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. **System resiliency**: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. **Environment**: Major externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses that likely lead to bankruptcy of multiple persons. **Psychological**: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold. **Physical harm**: Loss of life (IEC 61508 Critical). **Operator resiliency**: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. **System resiliency**: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. **Environment**: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. **Financial**: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. **Psychological**: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. **Physical harm**: Multiple loss of life (IEC 61508 Catastrophic). **Operator resiliency**: Operator incapacitated (includes fatality or otherwise incapacitated). **System resiliency**: Total loss of whole cyber-physical system, of which the software is a part. **Environment**: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. **Financial**: Social systems (elections, financial grid, etc.) supported by the software collapse. **Psychological**: N/A." + } + ] + }, + "ssvc:MI:2.0.0": { + "namespace": "ssvc", + "key": "MI", + "version": "2.0.0", + "name": "Mission Impact", + "definition": "Impact on Mission Essential Functions of the Organization", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Degraded", + "definition": "Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions" + }, + { + "key": "MSC", + "name": "MEF Support Crippled", + "definition": "Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + { + "key": "MEF", + "name": "MEF Failure", + "definition": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + }, + { + "key": "MF", + "name": "Mission Failure", + "definition": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + } + ] + }, + "ssvc:HI:2.0.2": { + "namespace": "ssvc", + "key": "HI", + "version": "2.0.2", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] + } + }, + "outcome": "ssvc:HI:2.0.2", + "mapping": [ + { + "ssvc:SI:2.0.1": "N", + "ssvc:MI:2.0.0": "D", + "ssvc:HI:2.0.2": "L" + }, + { + "ssvc:SI:2.0.1": "N", + "ssvc:MI:2.0.0": "MSC", + "ssvc:HI:2.0.2": "L" + }, + { + "ssvc:SI:2.0.1": "N", + "ssvc:MI:2.0.0": "MEF", + "ssvc:HI:2.0.2": "M" + }, + { + "ssvc:SI:2.0.1": "N", + "ssvc:MI:2.0.0": "MF", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:MI:2.0.0": "D", + "ssvc:HI:2.0.2": "L" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:MI:2.0.0": "MSC", + "ssvc:HI:2.0.2": "L" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:MI:2.0.0": "MEF", + "ssvc:HI:2.0.2": "M" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:MI:2.0.0": "MF", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:MI:2.0.0": "D", + "ssvc:HI:2.0.2": "M" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:MI:2.0.0": "MSC", + "ssvc:HI:2.0.2": "H" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:MI:2.0.0": "MEF", + "ssvc:HI:2.0.2": "H" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:MI:2.0.0": "MF", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:MI:2.0.0": "D", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:MI:2.0.0": "MSC", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:MI:2.0.0": "MEF", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:MI:2.0.0": "MF", + "ssvc:HI:2.0.2": "VH" + } + ] +} diff --git a/data/json/decision_tables/ssvc/public_safety_impact_1_0_0.json b/data/json/decision_tables/ssvc/public_safety_impact_1_0_0.json new file mode 100644 index 00000000..6eeebef6 --- /dev/null +++ b/data/json/decision_tables/ssvc/public_safety_impact_1_0_0.json @@ -0,0 +1,79 @@ +{ + "namespace": "ssvc", + "key": "DT_PSI", + "version": "1.0.0", + "name": "Public Safety Impact", + "definition": "Public Safety Impact Decision Table", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:SI:2.0.1": { + "namespace": "ssvc", + "key": "SI", + "version": "2.0.1", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability. (based on IEC 61508 with modifications)", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold. **Physical harm**: Minor injuries at worst (IEC 61508 Negligible). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. **System resiliency**: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. **Environment**: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses, which are not readily absorbable, to multiple persons. **Psychological**: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold. **Physical harm**: Major injuries to one or more persons (IEC 61508 Marginal). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. **System resiliency**: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. **Environment**: Major externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses that likely lead to bankruptcy of multiple persons. **Psychological**: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold. **Physical harm**: Loss of life (IEC 61508 Critical). **Operator resiliency**: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. **System resiliency**: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. **Environment**: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. **Financial**: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. **Psychological**: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. **Physical harm**: Multiple loss of life (IEC 61508 Catastrophic). **Operator resiliency**: Operator incapacitated (includes fatality or otherwise incapacitated). **System resiliency**: Total loss of whole cyber-physical system, of which the software is a part. **Environment**: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. **Financial**: Social systems (elections, financial grid, etc.) supported by the software collapse. **Psychological**: N/A." + } + ] + }, + "ssvc:PSI:2.0.1": { + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.1", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:Negligible" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + } + ] + } + }, + "outcome": "ssvc:PSI:2.0.1", + "mapping": [ + { + "ssvc:SI:2.0.1": "N", + "ssvc:PSI:2.0.1": "M" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:PSI:2.0.1": "S" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:PSI:2.0.1": "S" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:PSI:2.0.1": "S" + } + ] +} diff --git a/data/json/decision_tables/ssvc/supplier_patch_development_priority_1_0_0.json b/data/json/decision_tables/ssvc/supplier_patch_development_priority_1_0_0.json new file mode 100644 index 00000000..0adff324 --- /dev/null +++ b/data/json/decision_tables/ssvc/supplier_patch_development_priority_1_0_0.json @@ -0,0 +1,385 @@ +{ + "namespace": "ssvc", + "key": "DT_SP", + "version": "1.0.0", + "name": "Supplier Patch Development Priority", + "definition": "Decision table for evaluating supplier patch development priority in SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:E:1.1.0": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "ssvc:U:1.0.1": { + "namespace": "ssvc", + "key": "U", + "version": "1.0.1", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + ] + }, + "ssvc:TI:1.0.0": { + "namespace": "ssvc", + "key": "TI", + "version": "1.0.0", + "name": "Technical Impact", + "definition": "The technical impact of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Partial", + "definition": "The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control." + }, + { + "key": "T", + "name": "Total", + "definition": "The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability." + } + ] + }, + "ssvc:PSI:2.0.1": { + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.1", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:Negligible" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + } + ] + }, + "ssvc:DSOI:1.0.0": { + "namespace": "ssvc", + "key": "DSOI", + "version": "1.0.0", + "name": "Defer, Scheduled, Out-of-Cycle, Immediate", + "definition": "The original SSVC outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Defer", + "definition": "Defer" + }, + { + "key": "S", + "name": "Scheduled", + "definition": "Scheduled" + }, + { + "key": "O", + "name": "Out-of-Cycle", + "definition": "Out-of-Cycle" + }, + { + "key": "I", + "name": "Immediate", + "definition": "Immediate" + } + ] + } + }, + "outcome": "ssvc:DSOI:1.0.0", + "mapping": [ + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + } + ] +} diff --git a/data/json/decision_tables/ssvc/utility_1_0_0.json b/data/json/decision_tables/ssvc/utility_1_0_0.json new file mode 100644 index 00000000..af8e8cba --- /dev/null +++ b/data/json/decision_tables/ssvc/utility_1_0_0.json @@ -0,0 +1,98 @@ +{ + "namespace": "ssvc", + "key": "DT_U", + "version": "1.0.0", + "name": "Utility", + "definition": "Utility decision table for SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:A:2.0.0": { + "namespace": "ssvc", + "key": "A", + "version": "2.0.0", + "name": "Automatable", + "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + ] + }, + "ssvc:VD:1.0.0": { + "namespace": "ssvc", + "key": "VD", + "version": "1.0.0", + "name": "Value Density", + "definition": "The concentration of value in the target", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Diffuse", + "definition": "The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small." + }, + { + "key": "C", + "name": "Concentrated", + "definition": "The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users." + } + ] + }, + "ssvc:U:1.0.1": { + "namespace": "ssvc", + "key": "U", + "version": "1.0.1", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + ] + } + }, + "outcome": "ssvc:U:1.0.1", + "mapping": [ + { + "ssvc:A:2.0.0": "N", + "ssvc:VD:1.0.0": "D", + "ssvc:U:1.0.1": "L" + }, + { + "ssvc:A:2.0.0": "N", + "ssvc:VD:1.0.0": "C", + "ssvc:U:1.0.1": "E" + }, + { + "ssvc:A:2.0.0": "Y", + "ssvc:VD:1.0.0": "D", + "ssvc:U:1.0.1": "E" + }, + { + "ssvc:A:2.0.0": "Y", + "ssvc:VD:1.0.0": "C", + "ssvc:U:1.0.1": "S" + } + ] +} diff --git a/data/json/outcomes/CISA.json b/data/json/outcomes/CISA.json deleted file mode 100644 index c4ebbd2a..00000000 --- a/data/json/outcomes/CISA.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "version": "1.0.0", - "schemaVersion": "1-0-1", - "name": "CISA Levels", - "description": "The CISA outcome group. CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Track*, Attend, and Act.", - "outcomes": [ - { - "key": "T", - "name": "Track", - "description": "The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines." - }, - { - "key": "T*", - "name": "Track*", - "description": "The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines." - }, - { - "key": "A", - "name": "Attend", - "description": "The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines." - }, - { - "key": "A", - "name": "Act", - "description": "The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible." - } - ] -} \ No newline at end of file diff --git a/data/json/outcomes/CVSS.json b/data/json/outcomes/CVSS.json deleted file mode 100644 index 5d3d3bd2..00000000 --- a/data/json/outcomes/CVSS.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "version": "1.0.0", - "schemaVersion": "1-0-1", - "name": "CVSS Levels", - "description": "The CVSS outcome group.", - "outcomes": [ - { - "key": "L", - "name": "Low", - "description": "Low" - }, - { - "key": "M", - "name": "Medium", - "description": "Medium" - }, - { - "key": "H", - "name": "High", - "description": "High" - }, - { - "key": "C", - "name": "Critical", - "description": "Critical" - } - ] -} \ No newline at end of file diff --git a/data/json/outcomes/MOSCOW.json b/data/json/outcomes/MOSCOW.json deleted file mode 100644 index 3156c47d..00000000 --- a/data/json/outcomes/MOSCOW.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "version": "1.0.0", - "schemaVersion": "1-0-1", - "name": "Must, Should, Could, Won't", - "description": "The Moscow outcome group.", - "outcomes": [ - { - "key": "W", - "name": "Won't", - "description": "Won't" - }, - { - "key": "C", - "name": "Could", - "description": "Could" - }, - { - "key": "S", - "name": "Should", - "description": "Should" - }, - { - "key": "M", - "name": "Must", - "description": "Must" - } - ] -} \ No newline at end of file diff --git a/data/json/outcomes/PUBLISH.json b/data/json/outcomes/PUBLISH.json deleted file mode 100644 index fd656624..00000000 --- a/data/json/outcomes/PUBLISH.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "version": "1.0.0", - "schemaVersion": "1-0-1", - "name": "Publish, Do Not Publish", - "description": "The publish outcome group.", - "outcomes": [ - { - "key": "N", - "name": "Do Not Publish", - "description": "Do Not Publish" - }, - { - "key": "P", - "name": "Publish", - "description": "Publish" - } - ] -} \ No newline at end of file diff --git a/data/json/outcomes/YES_NO.json b/data/json/outcomes/YES_NO.json deleted file mode 100644 index 1a6dcdff..00000000 --- a/data/json/outcomes/YES_NO.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "version": "1.0.0", - "schemaVersion": "1-0-1", - "name": "Yes, No", - "description": "The Yes/No outcome group.", - "outcomes": [ - { - "key": "N", - "name": "No", - "description": "No" - }, - { - "key": "Y", - "name": "Yes", - "description": "Yes" - } - ] -} \ No newline at end of file diff --git a/data/json/ssvc_object_registry.json b/data/json/ssvc_object_registry.json new file mode 100644 index 00000000..da406f0e --- /dev/null +++ b/data/json/ssvc_object_registry.json @@ -0,0 +1,23083 @@ +{ + "name": "SSVC Object Registry", + "definition": "A registry for SSVC objects organized by type, namespace, key, and version.", + "schemaVersion": "2.0.0", + "types": { + "DecisionPoint": { + "type": "DecisionPoint", + "namespaces": { + "basic": { + "namespace": "basic", + "keys": { + "BP": { + "key": "BP", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "BP", + "version": "1.0.0", + "name": "Boundary Proximity", + "definition": "Indicates whether another value is near a boundary condition, indicating that special consideration may be needed.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "NN", + "name": "Not Near Boundary", + "definition": "The value is not near a boundary condition" + }, + { + "key": "JA", + "name": "Just Above Boundary", + "definition": "The value is just above a boundary condition" + }, + { + "key": "JB", + "name": "Just Below Boundary", + "definition": "The value is just below a boundary condition" + } + ] + }, + "values": { + "NN": { + "key": "NN", + "name": "Not Near Boundary", + "definition": "The value is not near a boundary condition" + }, + "JA": { + "key": "JA", + "name": "Just Above Boundary", + "definition": "The value is just above a boundary condition" + }, + "JB": { + "key": "JB", + "name": "Just Below Boundary", + "definition": "The value is just below a boundary condition" + } + } + } + } + }, + "CIS_WEP": { + "key": "CIS_WEP", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "CIS_WEP", + "version": "1.0.0", + "name": "CIS-CTI Words of Estimative Probability", + "definition": "A scale for expressing the likelihood of an event or outcome.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "ANC", + "name": "Almost No Chance", + "definition": "Probability < 0.05. Almost no chance, remote" + }, + { + "key": "VU", + "name": "Very Unlikely", + "definition": "0.05 <= Probability < 0.20. Very unlikely, highly improbable." + }, + { + "key": "U", + "name": "Unlikely", + "definition": "0.20 <= Probability < 0.45. Unlikely, improbable." + }, + { + "key": "REC", + "name": "Roughly Even Chance", + "definition": "0.45 <= Probability < 0.55. Roughly even chance, roughly even odds." + }, + { + "key": "L", + "name": "Likely", + "definition": "0.55 <= Probability < 0.80. Likely, probable." + }, + { + "key": "VL", + "name": "Very Likely", + "definition": "0.80 <= Probability < 0.95. Very likely, highly probable." + }, + { + "key": "AC", + "name": "Almost Certain", + "definition": "0.95 <= Probability. Almost certain, nearly certain." + } + ] + }, + "values": { + "ANC": { + "key": "ANC", + "name": "Almost No Chance", + "definition": "Probability < 0.05. Almost no chance, remote" + }, + "VU": { + "key": "VU", + "name": "Very Unlikely", + "definition": "0.05 <= Probability < 0.20. Very unlikely, highly improbable." + }, + "U": { + "key": "U", + "name": "Unlikely", + "definition": "0.20 <= Probability < 0.45. Unlikely, improbable." + }, + "REC": { + "key": "REC", + "name": "Roughly Even Chance", + "definition": "0.45 <= Probability < 0.55. Roughly even chance, roughly even odds." + }, + "L": { + "key": "L", + "name": "Likely", + "definition": "0.55 <= Probability < 0.80. Likely, probable." + }, + "VL": { + "key": "VL", + "name": "Very Likely", + "definition": "0.80 <= Probability < 0.95. Very likely, highly probable." + }, + "AC": { + "key": "AC", + "name": "Almost Certain", + "definition": "0.95 <= Probability. Almost certain, nearly certain." + } + } + } + } + }, + "P_5A": { + "key": "P_5A", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "P_5A", + "version": "1.0.0", + "name": "Probability Scale in 5 equal levels, ascending", + "definition": "A probability scale with 20% increments", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P0_20", + "name": "Less than 20%", + "definition": "Probability < 0.2" + }, + { + "key": "P20_40", + "name": "20% to 40%", + "definition": "0.2 <= Probability < 0.4" + }, + { + "key": "P40_60", + "name": "40% to 60%", + "definition": "0.4 <= Probability < 0.6" + }, + { + "key": "P60_80", + "name": "60% to 80%", + "definition": "0.6 <= Probability < 0.8" + }, + { + "key": "P80_100", + "name": "Greater than 80%", + "definition": "0.8 <= Probability <= 1.0" + } + ] + }, + "values": { + "P0_20": { + "key": "P0_20", + "name": "Less than 20%", + "definition": "Probability < 0.2" + }, + "P20_40": { + "key": "P20_40", + "name": "20% to 40%", + "definition": "0.2 <= Probability < 0.4" + }, + "P40_60": { + "key": "P40_60", + "name": "40% to 60%", + "definition": "0.4 <= Probability < 0.6" + }, + "P60_80": { + "key": "P60_80", + "name": "60% to 80%", + "definition": "0.6 <= Probability < 0.8" + }, + "P80_100": { + "key": "P80_100", + "name": "Greater than 80%", + "definition": "0.8 <= Probability <= 1.0" + } + } + } + } + }, + "P_5W": { + "key": "P_5W", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "P_5W", + "version": "1.0.0", + "name": "Probability Scale in 5 weighted levels, ascending", + "definition": "A probability scale with higher resolution as probability increases", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P0_30", + "name": "Less than 30%", + "definition": "Probability < 0.3" + }, + { + "key": "P30_55", + "name": "30% to 55%", + "definition": "0.3 <= Probability < 0.55" + }, + { + "key": "P55_75", + "name": "55% to 75%", + "definition": "0.55 <= Probability < 0.75" + }, + { + "key": "P75_90", + "name": "75% to 90%", + "definition": "0.75 <= Probability < 0.9" + }, + { + "key": "P90_100", + "name": "Greater than 90%", + "definition": "0.9 <= Probability <= 1.0" + } + ] + }, + "values": { + "P0_30": { + "key": "P0_30", + "name": "Less than 30%", + "definition": "Probability < 0.3" + }, + "P30_55": { + "key": "P30_55", + "name": "30% to 55%", + "definition": "0.3 <= Probability < 0.55" + }, + "P55_75": { + "key": "P55_75", + "name": "55% to 75%", + "definition": "0.55 <= Probability < 0.75" + }, + "P75_90": { + "key": "P75_90", + "name": "75% to 90%", + "definition": "0.75 <= Probability < 0.9" + }, + "P90_100": { + "key": "P90_100", + "name": "Greater than 90%", + "definition": "0.9 <= Probability <= 1.0" + } + } + } + } + }, + "P_2A": { + "key": "P_2A", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "P_2A", + "version": "1.0.0", + "name": "Probability Scale in 2 equal levels, ascending", + "definition": "A probability scale that divides between less than 50% and greater than or equal to 50%", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "LT50", + "name": "Less than 50%", + "definition": "0.0 <= Probability < 0.5" + }, + { + "key": "GT50", + "name": "Greater than 50%", + "definition": "0.5 <= Probability <= 1.0" + } + ] + }, + "values": { + "LT50": { + "key": "LT50", + "name": "Less than 50%", + "definition": "0.0 <= Probability < 0.5" + }, + "GT50": { + "key": "GT50", + "name": "Greater than 50%", + "definition": "0.5 <= Probability <= 1.0" + } + } + } + } + }, + "MEDIAN": { + "key": "MEDIAN", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "MEDIAN", + "version": "1.0.0", + "name": "Median Split", + "definition": "A median split divides a distribution into two equal parts, with 50% of the values falling below the median and 50% above it.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "B", + "name": "Below Median", + "definition": "Quantile < 0.50. The lower half of the range of possible values." + }, + { + "key": "A", + "name": "Above Median", + "definition": "0.50 <= Quantile <= 1.0. The upper half of the range of possible values." + } + ] + }, + "values": { + "B": { + "key": "B", + "name": "Below Median", + "definition": "Quantile < 0.50. The lower half of the range of possible values." + }, + "A": { + "key": "A", + "name": "Above Median", + "definition": "0.50 <= Quantile <= 1.0. The upper half of the range of possible values." + } + } + } + } + }, + "QUARTILES": { + "key": "QUARTILES", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "QUARTILES", + "version": "1.0.0", + "name": "Quartiles", + "definition": "A quartile is one of four equal groups that a population can be divided into according to the distribution of values of a particular variable.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "Q1", + "name": "First Quartile", + "definition": "Quantile < 0.25. The lowest 25% of the range of possible values." + }, + { + "key": "Q2", + "name": "Second Quartile", + "definition": "0.25 <= Quantile < 0.50. The second lowest 25% of the range of possible values." + }, + { + "key": "Q3", + "name": "Third Quartile", + "definition": "0.50 <= Quantile < 0.75. The second highest 25% of the range of possible values." + }, + { + "key": "Q4", + "name": "Fourth Quartile", + "definition": "0.75 <= Quantile <= 1.0. The highest 25% of the range of possible values." + } + ] + }, + "values": { + "Q1": { + "key": "Q1", + "name": "First Quartile", + "definition": "Quantile < 0.25. The lowest 25% of the range of possible values." + }, + "Q2": { + "key": "Q2", + "name": "Second Quartile", + "definition": "0.25 <= Quantile < 0.50. The second lowest 25% of the range of possible values." + }, + "Q3": { + "key": "Q3", + "name": "Third Quartile", + "definition": "0.50 <= Quantile < 0.75. The second highest 25% of the range of possible values." + }, + "Q4": { + "key": "Q4", + "name": "Fourth Quartile", + "definition": "0.75 <= Quantile <= 1.0. The highest 25% of the range of possible values." + } + } + } + } + }, + "QUINTILES": { + "key": "QUINTILES", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "QUINTILES", + "version": "1.0.0", + "name": "Quintiles", + "definition": "A quintile is one of five equal groups that a population can be divided into according to the distribution of values of a particular variable.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "Q1", + "name": "First Quintile", + "definition": "Quantile < 0.20. The lowest 20% of the range of possible values." + }, + { + "key": "Q2", + "name": "Second Quintile", + "definition": "0.20 <= Quantile < 0.40. The second lowest 20% of the range of possible values." + }, + { + "key": "Q3", + "name": "Third Quintile", + "definition": "0.40 <= Quantile < 0.60. The middle 20% of the range of possible values." + }, + { + "key": "Q4", + "name": "Fourth Quintile", + "definition": "0.60 <= Quantile < 0.80. The second highest 20% of the range of possible values." + }, + { + "key": "Q5", + "name": "Fifth Quintile", + "definition": "0.80 <= Quantile <= 1.0. The highest 20% of the range of possible values." + } + ] + }, + "values": { + "Q1": { + "key": "Q1", + "name": "First Quintile", + "definition": "Quantile < 0.20. The lowest 20% of the range of possible values." + }, + "Q2": { + "key": "Q2", + "name": "Second Quintile", + "definition": "0.20 <= Quantile < 0.40. The second lowest 20% of the range of possible values." + }, + "Q3": { + "key": "Q3", + "name": "Third Quintile", + "definition": "0.40 <= Quantile < 0.60. The middle 20% of the range of possible values." + }, + "Q4": { + "key": "Q4", + "name": "Fourth Quintile", + "definition": "0.60 <= Quantile < 0.80. The second highest 20% of the range of possible values." + }, + "Q5": { + "key": "Q5", + "name": "Fifth Quintile", + "definition": "0.80 <= Quantile <= 1.0. The highest 20% of the range of possible values." + } + } + } + } + }, + "IKE": { + "key": "IKE", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "IKE", + "version": "1.0.0", + "name": "Do, Schedule, Delegate, Delete", + "definition": "The Eisenhower outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Delete", + "definition": "Delete" + }, + { + "key": "G", + "name": "Delegate", + "definition": "Delegate" + }, + { + "key": "S", + "name": "Schedule", + "definition": "Schedule" + }, + { + "key": "O", + "name": "Do", + "definition": "Do" + } + ] + }, + "values": { + "D": { + "key": "D", + "name": "Delete", + "definition": "Delete" + }, + "G": { + "key": "G", + "name": "Delegate", + "definition": "Delegate" + }, + "S": { + "key": "S", + "name": "Schedule", + "definition": "Schedule" + }, + "O": { + "key": "O", + "name": "Do", + "definition": "Do" + } + } + } + } + }, + "LMH": { + "key": "LMH", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "LMH", + "version": "1.0.0", + "name": "LowMediumHigh", + "definition": "A Low/Medium/High decision point / outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Low" + }, + { + "key": "M", + "name": "Medium", + "definition": "Medium" + }, + { + "key": "H", + "name": "High", + "definition": "High" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Low" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Medium" + }, + "H": { + "key": "H", + "name": "High", + "definition": "High" + } + } + } + } + }, + "MSCW": { + "key": "MSCW", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "MSCW", + "version": "1.0.0", + "name": "MoSCoW", + "definition": "The MoSCoW (Must, Should, Could, Won't) outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "W", + "name": "Won't", + "definition": "Won't" + }, + { + "key": "C", + "name": "Could", + "definition": "Could" + }, + { + "key": "S", + "name": "Should", + "definition": "Should" + }, + { + "key": "M", + "name": "Must", + "definition": "Must" + } + ] + }, + "values": { + "W": { + "key": "W", + "name": "Won't", + "definition": "Won't" + }, + "C": { + "key": "C", + "name": "Could", + "definition": "Could" + }, + "S": { + "key": "S", + "name": "Should", + "definition": "Should" + }, + "M": { + "key": "M", + "name": "Must", + "definition": "Must" + } + } + } + } + }, + "VALUE_COMPLEXITY": { + "key": "VALUE_COMPLEXITY", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "VALUE_COMPLEXITY", + "version": "1.0.0", + "name": "Value, Complexity", + "definition": "The Value/Complexity outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Drop", + "definition": "Drop" + }, + { + "key": "R", + "name": "Reconsider Later", + "definition": "Reconsider Later" + }, + { + "key": "E", + "name": "Easy Win", + "definition": "Easy Win" + }, + { + "key": "F", + "name": "Do First", + "definition": "Do First" + } + ] + }, + "values": { + "D": { + "key": "D", + "name": "Drop", + "definition": "Drop" + }, + "R": { + "key": "R", + "name": "Reconsider Later", + "definition": "Reconsider Later" + }, + "E": { + "key": "E", + "name": "Easy Win", + "definition": "Easy Win" + }, + "F": { + "key": "F", + "name": "Do First", + "definition": "Do First" + } + } + } + } + }, + "YN": { + "key": "YN", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "basic", + "key": "YN", + "version": "1.0.0", + "name": "YesNo", + "definition": "A Yes/No decision point / outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "No" + }, + { + "key": "Y", + "name": "Yes", + "definition": "Yes" + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "No", + "definition": "No" + }, + "Y": { + "key": "Y", + "name": "Yes", + "definition": "Yes" + } + } + } + } + } + } + }, + "cisa": { + "namespace": "cisa", + "keys": { + "KEV": { + "key": "KEV", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cisa", + "key": "KEV", + "version": "1.0.0", + "name": "In KEV", + "definition": "Denotes whether a vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) list.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Vulnerability is not listed in KEV." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Vulnerability is listed in KEV." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "No", + "definition": "Vulnerability is not listed in KEV." + }, + "Y": { + "key": "Y", + "name": "Yes", + "definition": "Vulnerability is listed in KEV." + } + } + } + } + }, + "MP": { + "key": "MP", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cisa", + "key": "MP", + "version": "1.0.0", + "name": "Mission Prevalence", + "definition": "Prevalence of the mission essential functions", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Neither Support nor Essential apply. The vulnerable component may be used within the entities, but it is not used as a mission-essential component, nor does it provide impactful support to mission-essential functions." + }, + { + "key": "S", + "name": "Support", + "definition": "The vulnerable component only supports MEFs for two or more entities." + }, + { + "key": "E", + "name": "Essential", + "definition": "The vulnerable component directly provides capabilities that constitute at least one MEF for at least one entity; component failure may (but does not necessarily) lead to overall mission failure." + } + ] + }, + "values": { + "M": { + "key": "M", + "name": "Minimal", + "definition": "Neither Support nor Essential apply. The vulnerable component may be used within the entities, but it is not used as a mission-essential component, nor does it provide impactful support to mission-essential functions." + }, + "S": { + "key": "S", + "name": "Support", + "definition": "The vulnerable component only supports MEFs for two or more entities." + }, + "E": { + "key": "E", + "name": "Essential", + "definition": "The vulnerable component directly provides capabilities that constitute at least one MEF for at least one entity; component failure may (but does not necessarily) lead to overall mission failure." + } + } + } + } + }, + "CISA": { + "key": "CISA", + "versions": { + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "cisa", + "key": "CISA", + "version": "1.1.0", + "name": "CISA Levels", + "definition": "The CISA outcome group. CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Track*, Attend, and Act.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "T", + "name": "Track", + "definition": "The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines." + }, + { + "key": "T*", + "name": "Track*", + "definition": "The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines." + }, + { + "key": "AT", + "name": "Attend", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines." + }, + { + "key": "AC", + "name": "Act", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible." + } + ] + }, + "values": { + "T": { + "key": "T", + "name": "Track", + "definition": "The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines." + }, + "T*": { + "key": "T*", + "name": "Track*", + "definition": "The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines." + }, + "AT": { + "key": "AT", + "name": "Attend", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines." + }, + "AC": { + "key": "AC", + "name": "Act", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible." + } + } + } + } + } + } + }, + "cvss": { + "namespace": "cvss", + "keys": { + "AC": { + "key": "AC", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "AC", + "version": "1.0.0", + "name": "Access Complexity", + "definition": "This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "Specialized access conditions exist; for example: the system is exploitable during specific windows of time (a race condition), the system is exploitable under specific circumstances (nondefault configurations), or the system is exploitable with victim interaction (vulnerability exploitable only if user opens e-mail)" + }, + { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist; the system is always exploitable." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "Specialized access conditions exist; for example: the system is exploitable during specific windows of time (a race condition), the system is exploitable under specific circumstances (nondefault configurations), or the system is exploitable with victim interaction (vulnerability exploitable only if user opens e-mail)" + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist; the system is always exploitable." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "AC", + "version": "2.0.0", + "name": "Access Complexity", + "definition": "This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "Specialized access conditions exist." + }, + { + "key": "M", + "name": "Medium", + "definition": "The access conditions are somewhat specialized." + }, + { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "Specialized access conditions exist." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "The access conditions are somewhat specialized." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist." + } + } + }, + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "AC", + "version": "3.0.0", + "name": "Attack Complexity", + "definition": "This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "A successful attack depends on conditions beyond the attacker's control." + }, + { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "A successful attack depends on conditions beyond the attacker's control." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component." + } + } + }, + "3.0.1": { + "version": "3.0.1", + "obj": { + "namespace": "cvss", + "key": "AC", + "version": "3.0.1", + "name": "Attack Complexity", + "definition": "This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. ", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " + } + } + } + } + }, + "AT": { + "key": "AT", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "AT", + "version": "1.0.0", + "name": "Attack Requirements", + "definition": "This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Present", + "definition": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + }, + { + "key": "N", + "name": "None", + "definition": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." + } + ] + }, + "values": { + "P": { + "key": "P", + "name": "Present", + "definition": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." + } + } + } + } + }, + "AV": { + "key": "AV", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "AV", + "version": "1.0.0", + "name": "Access Vector", + "definition": "This metric measures whether or not the vulnerability is exploitable locally or remotely.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Local", + "definition": "The vulnerability is only exploitable locally (i.e., it requires physical access or authenticated login to the target system)" + }, + { + "key": "R", + "name": "Remote", + "definition": "The vulnerability is exploitable remotely." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Local", + "definition": "The vulnerability is only exploitable locally (i.e., it requires physical access or authenticated login to the target system)" + }, + "R": { + "key": "R", + "name": "Remote", + "definition": "The vulnerability is exploitable remotely." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "AV", + "version": "2.0.0", + "name": "Access Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Local", + "definition": "A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account." + }, + { + "key": "A", + "name": "Adjacent Network", + "definition": "A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software." + }, + { + "key": "N", + "name": "Network", + "definition": "A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed 'remotely exploitable'." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Local", + "definition": "A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account." + }, + "A": { + "key": "A", + "name": "Adjacent Network", + "definition": "A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software." + }, + "N": { + "key": "N", + "name": "Network", + "definition": "A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed 'remotely exploitable'." + } + } + }, + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "AV", + "version": "3.0.0", + "name": "Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. ", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Physical", + "definition": "A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent." + }, + { + "key": "L", + "name": "Local", + "definition": "A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file." + }, + { + "key": "A", + "name": "Adjacent", + "definition": "A vulnerability exploitable with adjacent network access means the vulnerable component is bound to the network stack, however the attack is limited to the same shared physical (e.g. Bluetooth, IEEE 802.11), or logical (e.g. local IP subnet) network, and cannot be performed across an OSI layer 3 boundary (e.g. a router)." + }, + { + "key": "N", + "name": "Network", + "definition": "A vulnerability exploitable with network access means the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (the network layer). Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable one or more network hops away (e.g. across layer 3 boundaries from routers)." + } + ] + }, + "values": { + "P": { + "key": "P", + "name": "Physical", + "definition": "A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent." + }, + "L": { + "key": "L", + "name": "Local", + "definition": "A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file." + }, + "A": { + "key": "A", + "name": "Adjacent", + "definition": "A vulnerability exploitable with adjacent network access means the vulnerable component is bound to the network stack, however the attack is limited to the same shared physical (e.g. Bluetooth, IEEE 802.11), or logical (e.g. local IP subnet) network, and cannot be performed across an OSI layer 3 boundary (e.g. a router)." + }, + "N": { + "key": "N", + "name": "Network", + "definition": "A vulnerability exploitable with network access means the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (the network layer). Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable one or more network hops away (e.g. across layer 3 boundaries from routers)." + } + } + }, + "3.0.1": { + "version": "3.0.1", + "obj": { + "namespace": "cvss", + "key": "AV", + "version": "3.0.1", + "name": "Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Physical", + "definition": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." + }, + { + "key": "L", + "name": "Local", + "definition": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." + }, + { + "key": "A", + "name": "Adjacent", + "definition": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." + }, + { + "key": "N", + "name": "Network", + "definition": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." + } + ] + }, + "values": { + "P": { + "key": "P", + "name": "Physical", + "definition": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." + }, + "L": { + "key": "L", + "name": "Local", + "definition": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." + }, + "A": { + "key": "A", + "name": "Adjacent", + "definition": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." + }, + "N": { + "key": "N", + "name": "Network", + "definition": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." + } + } + } + } + }, + "Au": { + "key": "Au", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "Au", + "version": "1.0.0", + "name": "Authentication", + "definition": "This metric measures whether or not an attacker needs to be authenticated to the target system in order to exploit the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Not Required", + "definition": "Authentication is not required to access or exploit the vulnerability." + }, + { + "key": "R", + "name": "Required", + "definition": "Authentication is required to access and exploit the vulnerability." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Not Required", + "definition": "Authentication is not required to access or exploit the vulnerability." + }, + "R": { + "key": "R", + "name": "Required", + "definition": "Authentication is required to access and exploit the vulnerability." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "Au", + "version": "2.0.0", + "name": "Authentication", + "definition": "This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The possible values for this metric are listed in Table 3. The fewer authentication instances that are required, the higher the vulnerability score.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Multiple", + "definition": "Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time." + }, + { + "key": "S", + "name": "Single", + "definition": "The vulnerability requires an attacker to be logged into the system (such as at a command line or via a desktop session or web interface)." + }, + { + "key": "N", + "name": "None", + "definition": "Authentication is not required to exploit the vulnerability." + } + ] + }, + "values": { + "M": { + "key": "M", + "name": "Multiple", + "definition": "Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time." + }, + "S": { + "key": "S", + "name": "Single", + "definition": "The vulnerability requires an attacker to be logged into the system (such as at a command line or via a desktop session or web interface)." + }, + "N": { + "key": "N", + "name": "None", + "definition": "Authentication is not required to exploit the vulnerability." + } + } + } + } + }, + "A": { + "key": "A", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "A", + "version": "1.0.0", + "name": "Availability Impact", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the target system.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "No impact on availability." + }, + { + "key": "P", + "name": "Partial", + "definition": "Considerable lag in or interruptions in resource availability. For example, a network-based flood attack that reduces available bandwidth to a web server farm to such an extent that only a small number of connections successfully complete." + }, + { + "key": "C", + "name": "Complete", + "definition": "Total shutdown of the affected resource. The attacker can render the resource completely unavailable." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "No impact on availability." + }, + "P": { + "key": "P", + "name": "Partial", + "definition": "Considerable lag in or interruptions in resource availability. For example, a network-based flood attack that reduces available bandwidth to a web server farm to such an extent that only a small number of connections successfully complete." + }, + "C": { + "key": "C", + "name": "Complete", + "definition": "Total shutdown of the affected resource. The attacker can render the resource completely unavailable." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "A", + "version": "2.0.0", + "name": "Availability Impact", + "definition": "This metric measures the impact to availability of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to the availability of the system." + }, + { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no impact to the availability of the system." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + } + } + } + }, + "VA": { + "key": "VA", + "versions": { + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "VA", + "version": "3.0.0", + "name": "Availability Impact to the Vulnerable System", + "definition": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + } + } + } + }, + "AR": { + "key": "AR", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "AR", + "version": "1.0.0", + "name": "Availability Requirement", + "definition": "This metric measures the impact to the availability of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "ND": { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "cvss", + "key": "AR", + "version": "1.1.0", + "name": "Availability Requirement", + "definition": "This metric measures the impact to the availability of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.1.1": { + "version": "1.1.1", + "obj": { + "namespace": "cvss", + "key": "AR", + "version": "1.1.1", + "name": "Availability Requirement", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Availability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "AR_NoX": { + "key": "AR_NoX", + "versions": { + "1.1.1": { + "version": "1.1.1", + "obj": { + "namespace": "cvss", + "key": "AR_NoX", + "version": "1.1.1", + "name": "Availability Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Availability. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + } + } + } + }, + "CDP": { + "key": "CDP", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "CDP", + "version": "1.0.0", + "name": "Collateral Damage Potential", + "definition": "This metric measures the potential for a loss in physical equipment, property damage or loss of life or limb.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no potential for physical or property damage." + }, + { + "key": "L", + "name": "Low", + "definition": "A successful exploit of this vulnerability may result in light physical or property damage or loss. The system itself may be damaged or destroyed." + }, + { + "key": "M", + "name": "Medium", + "definition": "A successful exploit of this vulnerability may result in significant physical or property damage or loss." + }, + { + "key": "H", + "name": "High", + "definition": "A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. The range of effect may be over a wide area." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no potential for physical or property damage." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "A successful exploit of this vulnerability may result in light physical or property damage or loss. The system itself may be damaged or destroyed." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "A successful exploit of this vulnerability may result in significant physical or property damage or loss." + }, + "H": { + "key": "H", + "name": "High", + "definition": "A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. The range of effect may be over a wide area." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "CDP", + "version": "2.0.0", + "name": "Collateral Damage Potential", + "definition": "This metric measures the potential for loss of life or physical assets.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no potential for loss of life, physical assets, productivity or revenue." + }, + { + "key": "LM", + "name": "Low-Medium", + "definition": "A successful exploit of this vulnerability may result in moderate physical or property damage or loss." + }, + { + "key": "MH", + "name": "Medium-High", + "definition": "A successful exploit of this vulnerability may result in significant physical or property damage or loss." + }, + { + "key": "H", + "name": "High", + "definition": "A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. The range of effect may be over a wide area." + }, + { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no potential for loss of life, physical assets, productivity or revenue." + }, + "LM": { + "key": "LM", + "name": "Low-Medium", + "definition": "A successful exploit of this vulnerability may result in moderate physical or property damage or loss." + }, + "MH": { + "key": "MH", + "name": "Medium-High", + "definition": "A successful exploit of this vulnerability may result in significant physical or property damage or loss." + }, + "H": { + "key": "H", + "name": "High", + "definition": "A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. The range of effect may be over a wide area." + }, + "ND": { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "C": { + "key": "C", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "C", + "version": "1.0.0", + "name": "Confidentiality Impact", + "definition": "This metric measures the impact on confidentiality of a successful exploit of the vulnerability on the target system.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "No impact on confidentiality." + }, + { + "key": "P", + "name": "Partial", + "definition": "There is considerable informational disclosure. Access to critical system files is possible. There is a loss of important information, but the attacker doesn't have control over what is obtainable or the scope of the loss is constrained." + }, + { + "key": "C", + "name": "Complete", + "definition": "A total compromise of critical system information. A complete loss of system protection resulting in all critical system files being revealed. The attacker has sovereign control to read all of the system's data (memory, files, etc)." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "No impact on confidentiality." + }, + "P": { + "key": "P", + "name": "Partial", + "definition": "There is considerable informational disclosure. Access to critical system files is possible. There is a loss of important information, but the attacker doesn't have control over what is obtainable or the scope of the loss is constrained." + }, + "C": { + "key": "C", + "name": "Complete", + "definition": "A total compromise of critical system information. A complete loss of system protection resulting in all critical system files being revealed. The attacker has sovereign control to read all of the system's data (memory, files, etc)." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "C", + "version": "2.0.0", + "name": "Confidentiality Impact", + "definition": "This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + } + } + } + } + }, + "VC": { + "key": "VC", + "versions": { + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "VC", + "version": "3.0.0", + "name": "Confidentiality Impact to the Vulnerable System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + } + } + } + } + }, + "CR": { + "key": "CR", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "CR", + "version": "1.0.0", + "name": "Confidentiality Requirement", + "definition": "This metric measures the impact to the confidentiality of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "ND": { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "cvss", + "key": "CR", + "version": "1.1.0", + "name": "Confidentiality Requirement", + "definition": "This metric measures the impact to the confidentiality of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.1.1": { + "version": "1.1.1", + "obj": { + "namespace": "cvss", + "key": "CR", + "version": "1.1.1", + "name": "Confidentiality Requirement", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "CR_NoX": { + "key": "CR_NoX", + "versions": { + "1.1.1": { + "version": "1.1.1", + "obj": { + "namespace": "cvss", + "key": "CR_NoX", + "version": "1.1.1", + "name": "Confidentiality Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + } + } + } + }, + "EQ1": { + "key": "EQ1", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "EQ1", + "version": "1.0.0", + "name": "Equivalence Set 1", + "definition": "AV/PR/UI with 3 levels specified in Table 24", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: AV:P or not(AV:N or PR:N or UI:N)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: AV:N and PR:N and UI:N" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "2: AV:P or not(AV:N or PR:N or UI:N)" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P" + }, + "H": { + "key": "H", + "name": "High", + "definition": "0: AV:N and PR:N and UI:N" + } + } + } + } + }, + "EQ2": { + "key": "EQ2", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "EQ2", + "version": "1.0.0", + "name": "Equivalence Set 2", + "definition": "AC/AT with 2 levels specified in Table 25", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (AC:L and AT:N)" + }, + { + "key": "H", + "name": "High", + "definition": "0: AC:L and AT:N" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "1: not (AC:L and AT:N)" + }, + "H": { + "key": "H", + "name": "High", + "definition": "0: AC:L and AT:N" + } + } + } + } + }, + "EQ3": { + "key": "EQ3", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "EQ3", + "version": "1.0.0", + "name": "Equivalence Set 3", + "definition": "VC/VI/VA with 3 levels specified in Table 26", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (VC:H or VI:H or VA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: VC:H and VI:H" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "2: not (VC:H or VI:H or VA:H)" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)" + }, + "H": { + "key": "H", + "name": "High", + "definition": "0: VC:H and VI:H" + } + } + } + } + }, + "EQ4": { + "key": "EQ4", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "EQ4", + "version": "1.0.0", + "name": "Equivalence Set 4", + "definition": "SC/SI/SA with 3 levels specified in Table 27", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: MSI:S or MSA:S" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "2: not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "1: not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)" + }, + "H": { + "key": "H", + "name": "High", + "definition": "0: MSI:S or MSA:S" + } + } + } + } + }, + "EQ5": { + "key": "EQ5", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "EQ5", + "version": "1.0.0", + "name": "Equivalence Set 5", + "definition": "E with 3 levels specified in Table 28", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: E:U" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: E:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: E:A" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "2: E:U" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "1: E:P" + }, + "H": { + "key": "H", + "name": "High", + "definition": "0: E:A" + } + } + } + } + }, + "EQ6": { + "key": "EQ6", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "EQ6", + "version": "1.0.0", + "name": "Equivalence Set 6", + "definition": "VC/VI/VA+CR/CI/CA with 2 levels specified in Table 29", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "1: not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)" + }, + "H": { + "key": "H", + "name": "High", + "definition": "0: (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)" + } + } + } + } + }, + "E": { + "key": "E", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "E", + "version": "1.0.0", + "name": "Exploitability", + "definition": "This metric measures the current state of exploit technique or code availability and suggests a likelihood of exploitation.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unproven", + "definition": "No exploit code is yet available or an exploit method is entirely theoretical." + }, + { + "key": "P", + "name": "Proof of Concept", + "definition": "Proof of concept exploit code or an attack demonstration that is not practically applicable to deployed systems is available. The code or technique is not functional in all situations and may require substantial hand tuning by a skilled attacker for use against deployed systems." + }, + { + "key": "F", + "name": "Functional", + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability is exploitable." + }, + { + "key": "H", + "name": "High", + "definition": "Either the vulnerability is exploitable by functional mobile autonomous code or no exploit is required (manual trigger) and the details for the manual technique are widely available. The code works in every situation where the vulnerability is exploitable and/or is actively being delivered via a mobile autonomous agent (a worm or virus)." + } + ] + }, + "values": { + "U": { + "key": "U", + "name": "Unproven", + "definition": "No exploit code is yet available or an exploit method is entirely theoretical." + }, + "P": { + "key": "P", + "name": "Proof of Concept", + "definition": "Proof of concept exploit code or an attack demonstration that is not practically applicable to deployed systems is available. The code or technique is not functional in all situations and may require substantial hand tuning by a skilled attacker for use against deployed systems." + }, + "F": { + "key": "F", + "name": "Functional", + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability is exploitable." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Either the vulnerability is exploitable by functional mobile autonomous code or no exploit is required (manual trigger) and the details for the manual technique are widely available. The code works in every situation where the vulnerability is exploitable and/or is actively being delivered via a mobile autonomous agent (a worm or virus)." + } + } + }, + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "cvss", + "key": "E", + "version": "1.1.0", + "name": "Exploitability", + "definition": "This metric measures the current state of exploit technique or code availability and suggests a likelihood of exploitation.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unproven", + "definition": "No exploit code is yet available or an exploit method is entirely theoretical." + }, + { + "key": "P", + "name": "Proof of Concept", + "definition": "Proof of concept exploit code or an attack demonstration that is not practically applicable to deployed systems is available. The code or technique is not functional in all situations and may require substantial hand tuning by a skilled attacker for use against deployed systems." + }, + { + "key": "F", + "name": "Functional", + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability is exploitable." + }, + { + "key": "H", + "name": "High", + "definition": "Either the vulnerability is exploitable by functional mobile autonomous code or no exploit is required (manual trigger) and the details for the manual technique are widely available. The code works in every situation where the vulnerability is exploitable and/or is actively being delivered via a mobile autonomous agent (a worm or virus)." + }, + { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "U": { + "key": "U", + "name": "Unproven", + "definition": "No exploit code is yet available or an exploit method is entirely theoretical." + }, + "P": { + "key": "P", + "name": "Proof of Concept", + "definition": "Proof of concept exploit code or an attack demonstration that is not practically applicable to deployed systems is available. The code or technique is not functional in all situations and may require substantial hand tuning by a skilled attacker for use against deployed systems." + }, + "F": { + "key": "F", + "name": "Functional", + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability is exploitable." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Either the vulnerability is exploitable by functional mobile autonomous code or no exploit is required (manual trigger) and the details for the manual technique are widely available. The code works in every situation where the vulnerability is exploitable and/or is actively being delivered via a mobile autonomous agent (a worm or virus)." + }, + "ND": { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.2.0": { + "version": "1.2.0", + "obj": { + "namespace": "cvss", + "key": "E", + "version": "1.2.0", + "name": "Exploit Code Maturity", + "definition": "measures the likelihood of the vulnerability being attacked, and is typically based on the current state of exploit techniques, exploit code availability, or active, 'in-the-wild' exploitation", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unproven", + "definition": "No exploit code is available, or an exploit is theoretical." + }, + { + "key": "POC", + "name": "Proof-of-Concept", + "definition": "Proof-of-concept exploit code is available, or an attack demonstration is not practical for most systems. The code or technique is not functional in all situations and may require substantial modification by a skilled attacker." + }, + { + "key": "F", + "name": "Functional", + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability exists." + }, + { + "key": "H", + "name": "High", + "definition": "Functional autonomous code exists, or no exploit is required (manual trigger) and details are widely available. Exploit code works in every situation, or is actively being delivered via an autonomous agent (such as a worm or virus). Network-connected systems are likely to encounter scanning or exploitation attempts. Exploit development has reached the level of reliable, widely-available, easy-to-use automated tools." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "U": { + "key": "U", + "name": "Unproven", + "definition": "No exploit code is available, or an exploit is theoretical." + }, + "POC": { + "key": "POC", + "name": "Proof-of-Concept", + "definition": "Proof-of-concept exploit code is available, or an attack demonstration is not practical for most systems. The code or technique is not functional in all situations and may require substantial modification by a skilled attacker." + }, + "F": { + "key": "F", + "name": "Functional", + "definition": "Functional exploit code is available. The code works in most situations where the vulnerability exists." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Functional autonomous code exists, or no exploit is required (manual trigger) and details are widely available. Exploit code works in every situation, or is actively being delivered via an autonomous agent (such as a worm or virus). Network-connected systems are likely to encounter scanning or exploitation attempts. Exploit development has reached the level of reliable, widely-available, easy-to-use automated tools." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "E", + "version": "2.0.0", + "name": "Exploit Maturity", + "definition": "This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unreported", + "definition": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" + }, + { + "key": "P", + "name": "Proof-of-Concept", + "definition": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" + }, + { + "key": "A", + "name": "Attacked", + "definition": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "U": { + "key": "U", + "name": "Unreported", + "definition": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" + }, + "P": { + "key": "P", + "name": "Proof-of-Concept", + "definition": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" + }, + "A": { + "key": "A", + "name": "Attacked", + "definition": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "E_NoX": { + "key": "E_NoX", + "versions": { + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "E_NoX", + "version": "2.0.0", + "name": "Exploit Maturity (without Not Defined)", + "definition": "This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unreported", + "definition": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" + }, + { + "key": "P", + "name": "Proof-of-Concept", + "definition": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" + }, + { + "key": "A", + "name": "Attacked", + "definition": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" + } + ] + }, + "values": { + "U": { + "key": "U", + "name": "Unreported", + "definition": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" + }, + "P": { + "key": "P", + "name": "Proof-of-Concept", + "definition": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" + }, + "A": { + "key": "A", + "name": "Attacked", + "definition": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" + } + } + } + } + }, + "IB": { + "key": "IB", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "IB", + "version": "1.0.0", + "name": "Impact Bias", + "definition": "This metric measures the impact bias of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Normal", + "definition": "Confidentiality Impact, Integrity Impact, and Availability Impact are all assigned the same weight." + }, + { + "key": "C", + "name": "Confidentiality", + "definition": "Confidentiality impact is assigned greater weight than Integrity Impact or Availability Impact." + }, + { + "key": "I", + "name": "Integrity", + "definition": "Integrity Impact is assigned greater weight than Confidentiality Impact or Availability Impact." + }, + { + "key": "A", + "name": "Availability", + "definition": "Availability Impact is assigned greater weight than Confidentiality Impact or Integrity Impact." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Normal", + "definition": "Confidentiality Impact, Integrity Impact, and Availability Impact are all assigned the same weight." + }, + "C": { + "key": "C", + "name": "Confidentiality", + "definition": "Confidentiality impact is assigned greater weight than Integrity Impact or Availability Impact." + }, + "I": { + "key": "I", + "name": "Integrity", + "definition": "Integrity Impact is assigned greater weight than Confidentiality Impact or Availability Impact." + }, + "A": { + "key": "A", + "name": "Availability", + "definition": "Availability Impact is assigned greater weight than Confidentiality Impact or Integrity Impact." + } + } + } + } + }, + "I": { + "key": "I", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "I", + "version": "1.0.0", + "name": "Integrity Impact", + "definition": "This metric measures the impact on integrity a successful exploit of the vulnerability will have on the target system.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "No impact on integrity." + }, + { + "key": "P", + "name": "Partial", + "definition": "Considerable breach in integrity. Modification of critical system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is constrained. For example, key system or program files may be overwritten or modified, but at random or in a limited context or scope." + }, + { + "key": "C", + "name": "Complete", + "definition": "A total compromise of system integrity. There is a complete loss of system protection resulting in the entire system being compromised. The attacker has sovereign control to modify any system files." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "No impact on integrity." + }, + "P": { + "key": "P", + "name": "Partial", + "definition": "Considerable breach in integrity. Modification of critical system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is constrained. For example, key system or program files may be overwritten or modified, but at random or in a limited context or scope." + }, + "C": { + "key": "C", + "name": "Complete", + "definition": "A total compromise of system integrity. There is a complete loss of system protection resulting in the entire system being compromised. The attacker has sovereign control to modify any system files." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "I", + "version": "2.0.0", + "name": "Integrity Impact", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to the integrity of the system." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. The data modification does not have a direct, serious impact on the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no impact to the integrity of the system." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. The data modification does not have a direct, serious impact on the impacted component." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + } + } + } + } + }, + "VI": { + "key": "VI", + "versions": { + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "VI", + "version": "3.0.0", + "name": "Integrity Impact to the Vulnerable System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + } + } + } + } + }, + "IR": { + "key": "IR", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "IR", + "version": "1.0.0", + "name": "Integrity Requirement", + "definition": "This metric measures the impact to the integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "ND": { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "cvss", + "key": "IR", + "version": "1.1.0", + "name": "Integrity Requirement", + "definition": "This metric measures the impact to the integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.1.1": { + "version": "1.1.1", + "obj": { + "namespace": "cvss", + "key": "IR", + "version": "1.1.1", + "name": "Integrity Requirement", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "IR_NoX": { + "key": "IR_NoX", + "versions": { + "1.1.1": { + "version": "1.1.1", + "obj": { + "namespace": "cvss", + "key": "IR_NoX", + "version": "1.1.1", + "name": "Integrity Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + } + } + } + }, + "SA": { + "key": "SA", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "SA", + "version": "1.0.0", + "name": "Availability Impact to the Subsequent System", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + } + } + } + }, + "MSA": { + "key": "MSA", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "MSA", + "version": "1.0.0", + "name": "Modified Availability Impact to the Subsequent System", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "cvss", + "key": "MSA", + "version": "1.0.1", + "name": "Modified Availability Impact to the Subsequent System", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "There is negligible impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + "S": { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + } + } + } + }, + "MSA_NoX": { + "key": "MSA_NoX", + "versions": { + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "cvss", + "key": "MSA_NoX", + "version": "1.0.1", + "name": "Modified Availability Impact to the Subsequent System (without Not Defined)", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "There is negligible impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + "S": { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + } + } + } + }, + "SI": { + "key": "SI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "SI", + "version": "1.0.0", + "name": "Integrity Impact to the Subsequent System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + } + } + } + } + }, + "MSI": { + "key": "MSI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "MSI", + "version": "1.0.0", + "name": "Modified Integrity Impact to the Subsequent System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "cvss", + "key": "MSI", + "version": "1.0.1", + "name": "Modified Integrity Impact to the Subsequent System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + "S": { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + } + } + } + }, + "MSI_NoX": { + "key": "MSI_NoX", + "versions": { + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "cvss", + "key": "MSI_NoX", + "version": "1.0.1", + "name": "Modified Integrity Impact to the Subsequent System (without Not Defined)", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + "S": { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + } + } + } + }, + "PR": { + "key": "PR", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "PR", + "version": "1.0.0", + "name": "Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources." + }, + { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + } + } + }, + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "cvss", + "key": "PR", + "version": "1.0.1", + "name": "Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." + }, + { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + } + } + } + } + }, + "QS": { + "key": "QS", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "QS", + "version": "1.0.0", + "name": "CVSS Qualitative Severity Rating Scale", + "definition": "The CVSS Qualitative Severity Rating Scale provides a categorical representation of a CVSS Score.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "No severity rating (0.0)" + }, + { + "key": "L", + "name": "Low", + "definition": "Low (0.1 - 3.9)" + }, + { + "key": "M", + "name": "Medium", + "definition": "Medium (4.0 - 6.9)" + }, + { + "key": "H", + "name": "High", + "definition": "High (7.0 - 8.9)" + }, + { + "key": "C", + "name": "Critical", + "definition": "Critical (9.0 - 10.0)" + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "No severity rating (0.0)" + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Low (0.1 - 3.9)" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Medium (4.0 - 6.9)" + }, + "H": { + "key": "H", + "name": "High", + "definition": "High (7.0 - 8.9)" + }, + "C": { + "key": "C", + "name": "Critical", + "definition": "Critical (9.0 - 10.0)" + } + } + } + } + }, + "RL": { + "key": "RL", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "RL", + "version": "1.0.0", + "name": "Remediation Level", + "definition": "This metric measures the remediation status of a vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "OF", + "name": "Official Fix", + "definition": "A complete vendor solution is available. Either the vendor has issued the final, official patch which eliminates the vulnerability or an upgrade that is not vulnerable is available." + }, + { + "key": "TF", + "name": "Temporary Fix", + "definition": "There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool or official workaround." + }, + { + "key": "W", + "name": "Workaround", + "definition": "There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate against the vulnerability. When it is generally accepted that these unofficial fixes are adequate in plugging the hole for the mean time and no official remediation is available, this value can be set." + }, + { + "key": "U", + "name": "Unavailable", + "definition": "There is either no solution available or it is impossible to apply." + } + ] + }, + "values": { + "OF": { + "key": "OF", + "name": "Official Fix", + "definition": "A complete vendor solution is available. Either the vendor has issued the final, official patch which eliminates the vulnerability or an upgrade that is not vulnerable is available." + }, + "TF": { + "key": "TF", + "name": "Temporary Fix", + "definition": "There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool or official workaround." + }, + "W": { + "key": "W", + "name": "Workaround", + "definition": "There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate against the vulnerability. When it is generally accepted that these unofficial fixes are adequate in plugging the hole for the mean time and no official remediation is available, this value can be set." + }, + "U": { + "key": "U", + "name": "Unavailable", + "definition": "There is either no solution available or it is impossible to apply." + } + } + }, + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "cvss", + "key": "RL", + "version": "1.1.0", + "name": "Remediation Level", + "definition": "This metric measures the remediation status of a vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "OF", + "name": "Official Fix", + "definition": "A complete vendor solution is available. Either the vendor has issued the final, official patch which eliminates the vulnerability or an upgrade that is not vulnerable is available." + }, + { + "key": "TF", + "name": "Temporary Fix", + "definition": "There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool or official workaround." + }, + { + "key": "W", + "name": "Workaround", + "definition": "There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate against the vulnerability. When it is generally accepted that these unofficial fixes are adequate in plugging the hole for the mean time and no official remediation is available, this value can be set." + }, + { + "key": "U", + "name": "Unavailable", + "definition": "There is either no solution available or it is impossible to apply." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "OF": { + "key": "OF", + "name": "Official Fix", + "definition": "A complete vendor solution is available. Either the vendor has issued the final, official patch which eliminates the vulnerability or an upgrade that is not vulnerable is available." + }, + "TF": { + "key": "TF", + "name": "Temporary Fix", + "definition": "There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool or official workaround." + }, + "W": { + "key": "W", + "name": "Workaround", + "definition": "There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate against the vulnerability. When it is generally accepted that these unofficial fixes are adequate in plugging the hole for the mean time and no official remediation is available, this value can be set." + }, + "U": { + "key": "U", + "name": "Unavailable", + "definition": "There is either no solution available or it is impossible to apply." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "RC": { + "key": "RC", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "RC", + "version": "1.0.0", + "name": "Report Confidence", + "definition": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "UC", + "name": "Unconfirmed", + "definition": "A single unconfirmed source or possibly several conflicting reports. There is little confidence in the validity of the report." + }, + { + "key": "UR", + "name": "Uncorroborated", + "definition": "Multiple non-official sources; possibily including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity." + }, + { + "key": "C", + "name": "Confirmed", + "definition": "Vendor or author of the affected technology has acknowledged that the vulnerability exists. This value may also be set when existence of a vulnerability is confirmed with absolute confidence through some other event, such as publication of functional proof of concept exploit code or widespread exploitation." + } + ] + }, + "values": { + "UC": { + "key": "UC", + "name": "Unconfirmed", + "definition": "A single unconfirmed source or possibly several conflicting reports. There is little confidence in the validity of the report." + }, + "UR": { + "key": "UR", + "name": "Uncorroborated", + "definition": "Multiple non-official sources; possibily including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity." + }, + "C": { + "key": "C", + "name": "Confirmed", + "definition": "Vendor or author of the affected technology has acknowledged that the vulnerability exists. This value may also be set when existence of a vulnerability is confirmed with absolute confidence through some other event, such as publication of functional proof of concept exploit code or widespread exploitation." + } + } + }, + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "cvss", + "key": "RC", + "version": "1.1.0", + "name": "Report Confidence", + "definition": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "UC", + "name": "Unconfirmed", + "definition": "A single unconfirmed source or possibly several conflicting reports. There is little confidence in the validity of the report." + }, + { + "key": "UR", + "name": "Uncorroborated", + "definition": "Multiple non-official sources; possibily including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity." + }, + { + "key": "C", + "name": "Confirmed", + "definition": "Vendor or author of the affected technology has acknowledged that the vulnerability exists. This value may also be set when existence of a vulnerability is confirmed with absolute confidence through some other event, such as publication of functional proof of concept exploit code or widespread exploitation." + }, + { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "UC": { + "key": "UC", + "name": "Unconfirmed", + "definition": "A single unconfirmed source or possibly several conflicting reports. There is little confidence in the validity of the report." + }, + "UR": { + "key": "UR", + "name": "Uncorroborated", + "definition": "Multiple non-official sources; possibily including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity." + }, + "C": { + "key": "C", + "name": "Confirmed", + "definition": "Vendor or author of the affected technology has acknowledged that the vulnerability exists. This value may also be set when existence of a vulnerability is confirmed with absolute confidence through some other event, such as publication of functional proof of concept exploit code or widespread exploitation." + }, + "ND": { + "key": "ND", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "RC", + "version": "2.0.0", + "name": "Report Confidence", + "definition": "This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unknown", + "definition": "There are reports of impacts that indicate a vulnerability is present. The reports indicate that the cause of the vulnerability is unknown, or reports may differ on the cause or impacts of the vulnerability. Reporters are uncertain of the true nature of the vulnerability, and there is little confidence in the validity of the reports or whether a static Base score can be applied given the differences described." + }, + { + "key": "R", + "name": "Reasonable", + "definition": "Significant details are published, but researchers either do not have full confidence in the root cause, or do not have access to source code to fully confirm all of the interactions that may lead to the result. Reasonable confidence exists, however, that the bug is reproducible and at least one impact is able to be verified (proof-of-concept exploits may provide this)." + }, + { + "key": "C", + "name": "Confirmed", + "definition": "Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "U": { + "key": "U", + "name": "Unknown", + "definition": "There are reports of impacts that indicate a vulnerability is present. The reports indicate that the cause of the vulnerability is unknown, or reports may differ on the cause or impacts of the vulnerability. Reporters are uncertain of the true nature of the vulnerability, and there is little confidence in the validity of the reports or whether a static Base score can be applied given the differences described." + }, + "R": { + "key": "R", + "name": "Reasonable", + "definition": "Significant details are published, but researchers either do not have full confidence in the root cause, or do not have access to source code to fully confirm all of the interactions that may lead to the result. Reasonable confidence exists, however, that the bug is reproducible and at least one impact is able to be verified (proof-of-concept exploits may provide this)." + }, + "C": { + "key": "C", + "name": "Confirmed", + "definition": "Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "S": { + "key": "S", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "S", + "version": "1.0.0", + "name": "Scope", + "definition": "the ability for a vulnerability in one software component to impact resources beyond its means, or privileges", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unchanged", + "definition": "An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same." + }, + { + "key": "C", + "name": "Changed", + "definition": "An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different." + } + ] + }, + "values": { + "U": { + "key": "U", + "name": "Unchanged", + "definition": "An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same." + }, + "C": { + "key": "C", + "name": "Changed", + "definition": "An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different." + } + } + } + } + }, + "SC": { + "key": "SC", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "SC", + "version": "1.0.0", + "name": "Confidentiality Impact to the Subsequent System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + } + } + } + } + }, + "AU": { + "key": "AU", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "AU", + "version": "1.0.0", + "name": "Automatable", + "definition": "The \"Automatable\" metric captures the answer to the question \"Can an attacker automate exploitation events for this vulnerability across multiple targets?\" based on steps 1-4 of the kill chain.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate all 4 steps of the kill chain for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate all 4 steps of the kill chain. These steps are reconnaissance, weaponization, delivery, and exploitation (e.g., the vulnerability is \"wormable\")." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate all 4 steps of the kill chain for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation." + }, + "Y": { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate all 4 steps of the kill chain. These steps are reconnaissance, weaponization, delivery, and exploitation (e.g., the vulnerability is \"wormable\")." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "U": { + "key": "U", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "U", + "version": "1.0.0", + "name": "Provider Urgency", + "definition": "Many vendors currently provide supplemental severity ratings to consumers via product security advisories. Other vendors publish Qualitative Severity Ratings from the CVSS Specification Document in their advisories. To facilitate a standardized method to incorporate additional provider-supplied assessment, an optional \"pass-through\" Supplemental Metric called Provider Urgency is available.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "C", + "name": "Clear", + "definition": "Provider has assessed the impact of this vulnerability as having no urgency (Informational)." + }, + { + "key": "G", + "name": "Green", + "definition": "Provider has assessed the impact of this vulnerability as having a reduced urgency." + }, + { + "key": "A", + "name": "Amber", + "definition": "Provider has assessed the impact of this vulnerability as having a moderate urgency." + }, + { + "key": "R", + "name": "Red", + "definition": "Provider has assessed the impact of this vulnerability as having the highest urgency." + } + ] + }, + "values": { + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + "C": { + "key": "C", + "name": "Clear", + "definition": "Provider has assessed the impact of this vulnerability as having no urgency (Informational)." + }, + "G": { + "key": "G", + "name": "Green", + "definition": "Provider has assessed the impact of this vulnerability as having a reduced urgency." + }, + "A": { + "key": "A", + "name": "Amber", + "definition": "Provider has assessed the impact of this vulnerability as having a moderate urgency." + }, + "R": { + "key": "R", + "name": "Red", + "definition": "Provider has assessed the impact of this vulnerability as having the highest urgency." + } + } + } + } + }, + "R": { + "key": "R", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "R", + "version": "1.0.0", + "name": "Recovery", + "definition": "The Recovery metric describes the resilience of a system to recover services, in terms of performance and availability, after an attack has been performed.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "A", + "name": "Automatic", + "definition": "The system recovers services automatically after an attack has been performed." + }, + { + "key": "U", + "name": "User", + "definition": "The system requires manual intervention by the user to recover services, after an attack has been performed." + }, + { + "key": "I", + "name": "Irrecoverable", + "definition": "The system services are irrecoverable by the user, after an attack has been performed." + } + ] + }, + "values": { + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + "A": { + "key": "A", + "name": "Automatic", + "definition": "The system recovers services automatically after an attack has been performed." + }, + "U": { + "key": "U", + "name": "User", + "definition": "The system requires manual intervention by the user to recover services, after an attack has been performed." + }, + "I": { + "key": "I", + "name": "Irrecoverable", + "definition": "The system services are irrecoverable by the user, after an attack has been performed." + } + } + } + } + }, + "SF": { + "key": "SF", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "SF", + "version": "1.0.0", + "name": "Safety", + "definition": "The Safety decision point is a measure of the potential for harm to humans or the environment.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "P", + "name": "Present", + "definition": "Consequences of the vulnerability meet definition of IEC 61508 consequence categories of \"marginal,\" \"critical,\" or \"catastrophic.\"" + }, + { + "key": "N", + "name": "Negligible", + "definition": "Consequences of the vulnerability meet definition of IEC 61508 consequence category \"negligible.\"" + } + ] + }, + "values": { + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + "P": { + "key": "P", + "name": "Present", + "definition": "Consequences of the vulnerability meet definition of IEC 61508 consequence categories of \"marginal,\" \"critical,\" or \"catastrophic.\"" + }, + "N": { + "key": "N", + "name": "Negligible", + "definition": "Consequences of the vulnerability meet definition of IEC 61508 consequence category \"negligible.\"" + } + } + } + } + }, + "V": { + "key": "V", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "V", + "version": "1.0.0", + "name": "Value Density", + "definition": "Value Density describes the resources that the attacker will gain control over with a single exploitation event. It has two possible values, diffuse and concentrated.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "D", + "name": "Diffuse", + "definition": "The vulnerable system has limited resources. That is, the resources that the attacker will gain control over with a single exploitation event are relatively small." + }, + { + "key": "C", + "name": "Concentrated", + "definition": "The vulnerable system is rich in resources. Heuristically, such systems are often the direct responsibility of \"system operators\" rather than users." + } + ] + }, + "values": { + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + "D": { + "key": "D", + "name": "Diffuse", + "definition": "The vulnerable system has limited resources. That is, the resources that the attacker will gain control over with a single exploitation event are relatively small." + }, + "C": { + "key": "C", + "name": "Concentrated", + "definition": "The vulnerable system is rich in resources. Heuristically, such systems are often the direct responsibility of \"system operators\" rather than users." + } + } + } + } + }, + "RE": { + "key": "RE", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "RE", + "version": "1.0.0", + "name": "Vulnerability Response Effort", + "definition": "The intention of the Vulnerability Response Effort metric is to provide supplemental information on how difficult it is for consumers to provide an initial response to the impact of vulnerabilities for deployed products and services in their infrastructure. The consumer can then take this additional information on effort required into consideration when applying mitigations and/or scheduling remediation.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + { + "key": "L", + "name": "Low", + "definition": "The effort required to respond to a vulnerability is low/trivial." + }, + { + "key": "M", + "name": "Moderate", + "definition": "The actions required to respond to a vulnerability require some effort on behalf of the consumer and could cause minimal service impact to implement." + }, + { + "key": "H", + "name": "High", + "definition": "The actions required to respond to a vulnerability are significant and/or difficult, and may possibly lead to an extended, scheduled service impact. This would need to be considered for scheduling purposes including honoring any embargo on deployment of the selected response. Alternatively, response to the vulnerability in the field is not possible remotely. The only resolution to the vulnerability involves physical replacement (e.g. units deployed would have to be recalled for a depot level repair or replacement)." + } + ] + }, + "values": { + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "The effort required to respond to a vulnerability is low/trivial." + }, + "M": { + "key": "M", + "name": "Moderate", + "definition": "The actions required to respond to a vulnerability require some effort on behalf of the consumer and could cause minimal service impact to implement." + }, + "H": { + "key": "H", + "name": "High", + "definition": "The actions required to respond to a vulnerability are significant and/or difficult, and may possibly lead to an extended, scheduled service impact. This would need to be considered for scheduling purposes including honoring any embargo on deployment of the selected response. Alternatively, response to the vulnerability in the field is not possible remotely. The only resolution to the vulnerability involves physical replacement (e.g. units deployed would have to be recalled for a depot level repair or replacement)." + } + } + } + } + }, + "TD": { + "key": "TD", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "TD", + "version": "1.0.0", + "name": "Target Distribution", + "definition": "This metric measures the relative size of the field of target systems susceptible to the vulnerability. It is meant as an environment-specific indicator in order to approximate the percentage of systems within the environment that could be affected by the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk." + }, + { + "key": "L", + "name": "Low", + "definition": "Targets exist inside the environment, but on a small scale. Between 1% - 15% of the total environment is at risk." + }, + { + "key": "M", + "name": "Medium", + "definition": "Targets exist inside the environment, but on a medium scale. Between 16% - 49% of the total environment is at risk." + }, + { + "key": "H", + "name": "High", + "definition": "Targets exist inside the environment on a considerable scale. Between 50% - 100% of the total environment is considered at risk." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Targets exist inside the environment, but on a small scale. Between 1% - 15% of the total environment is at risk." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Targets exist inside the environment, but on a medium scale. Between 16% - 49% of the total environment is at risk." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Targets exist inside the environment on a considerable scale. Between 50% - 100% of the total environment is considered at risk." + } + } + }, + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "cvss", + "key": "TD", + "version": "1.1.0", + "name": "Target Distribution", + "definition": "This metric measures the relative size of the field of target systems susceptible to the vulnerability. It is meant as an environment-specific indicator in order to approximate the percentage of systems within the environment that could be affected by the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk." + }, + { + "key": "L", + "name": "Low", + "definition": "Targets exist inside the environment, but on a small scale. Between 1% - 15% of the total environment is at risk." + }, + { + "key": "M", + "name": "Medium", + "definition": "Targets exist inside the environment, but on a medium scale. Between 16% - 49% of the total environment is at risk." + }, + { + "key": "H", + "name": "High", + "definition": "Targets exist inside the environment on a considerable scale. Between 50% - 100% of the total environment is considered at risk." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Targets exist inside the environment, but on a small scale. Between 1% - 15% of the total environment is at risk." + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Targets exist inside the environment, but on a medium scale. Between 16% - 49% of the total environment is at risk." + }, + "H": { + "key": "H", + "name": "High", + "definition": "Targets exist inside the environment on a considerable scale. Between 50% - 100% of the total environment is considered at risk." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "UI": { + "key": "UI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "UI", + "version": "1.0.0", + "name": "User Interaction", + "definition": "This metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "R", + "name": "Required", + "definition": "Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited." + }, + { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any user." + } + ] + }, + "values": { + "R": { + "key": "R", + "name": "Required", + "definition": "Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any user." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "UI", + "version": "2.0.0", + "name": "User Interaction", + "definition": "This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "A", + "name": "Active", + "definition": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." + }, + { + "key": "P", + "name": "Passive", + "definition": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." + }, + { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." + } + ] + }, + "values": { + "A": { + "key": "A", + "name": "Active", + "definition": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." + }, + "P": { + "key": "P", + "name": "Passive", + "definition": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." + } + } + } + } + }, + "CVSS": { + "key": "CVSS", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "CVSS", + "version": "1.0.0", + "name": "CVSS Qualitative Severity Rating Scale", + "definition": "The CVSS Qualitative Severity Rating Scale group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "None (0.0)" + }, + { + "key": "L", + "name": "Low", + "definition": "Low (0.1-3.9)" + }, + { + "key": "M", + "name": "Medium", + "definition": "Medium (4.0-6.9)" + }, + { + "key": "H", + "name": "High", + "definition": "High (7.0-8.9)" + }, + { + "key": "C", + "name": "Critical", + "definition": "Critical (9.0-10.0)" + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "None (0.0)" + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Low (0.1-3.9)" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Medium (4.0-6.9)" + }, + "H": { + "key": "H", + "name": "High", + "definition": "High (7.0-8.9)" + }, + "C": { + "key": "C", + "name": "Critical", + "definition": "Critical (9.0-10.0)" + } + } + } + } + }, + "MAV": { + "key": "MAV", + "versions": { + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "MAV", + "version": "3.0.0", + "name": "Modified Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. ", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Physical", + "definition": "A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent." + }, + { + "key": "L", + "name": "Local", + "definition": "A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file." + }, + { + "key": "A", + "name": "Adjacent", + "definition": "A vulnerability exploitable with adjacent network access means the vulnerable component is bound to the network stack, however the attack is limited to the same shared physical (e.g. Bluetooth, IEEE 802.11), or logical (e.g. local IP subnet) network, and cannot be performed across an OSI layer 3 boundary (e.g. a router)." + }, + { + "key": "N", + "name": "Network", + "definition": "A vulnerability exploitable with network access means the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (the network layer). Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable one or more network hops away (e.g. across layer 3 boundaries from routers)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "P": { + "key": "P", + "name": "Physical", + "definition": "A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent." + }, + "L": { + "key": "L", + "name": "Local", + "definition": "A vulnerability exploitable with Local access means that the vulnerable component is not bound to the network stack, and the attacker's path is via read/write/execute capabilities. In some cases, the attacker may be logged in locally in order to exploit the vulnerability, otherwise, she may rely on User Interaction to execute a malicious file." + }, + "A": { + "key": "A", + "name": "Adjacent", + "definition": "A vulnerability exploitable with adjacent network access means the vulnerable component is bound to the network stack, however the attack is limited to the same shared physical (e.g. Bluetooth, IEEE 802.11), or logical (e.g. local IP subnet) network, and cannot be performed across an OSI layer 3 boundary (e.g. a router)." + }, + "N": { + "key": "N", + "name": "Network", + "definition": "A vulnerability exploitable with network access means the vulnerable component is bound to the network stack and the attacker's path is through OSI layer 3 (the network layer). Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable one or more network hops away (e.g. across layer 3 boundaries from routers)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "3.0.1": { + "version": "3.0.1", + "obj": { + "namespace": "cvss", + "key": "MAV", + "version": "3.0.1", + "name": "Modified Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Physical", + "definition": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." + }, + { + "key": "L", + "name": "Local", + "definition": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." + }, + { + "key": "A", + "name": "Adjacent", + "definition": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." + }, + { + "key": "N", + "name": "Network", + "definition": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "P": { + "key": "P", + "name": "Physical", + "definition": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." + }, + "L": { + "key": "L", + "name": "Local", + "definition": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." + }, + "A": { + "key": "A", + "name": "Adjacent", + "definition": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." + }, + "N": { + "key": "N", + "name": "Network", + "definition": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MAC": { + "key": "MAC", + "versions": { + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "MAC", + "version": "3.0.0", + "name": "Modified Attack Complexity", + "definition": "This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "A successful attack depends on conditions beyond the attacker's control." + }, + { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "A successful attack depends on conditions beyond the attacker's control." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "3.0.1": { + "version": "3.0.1", + "obj": { + "namespace": "cvss", + "key": "MAC", + "version": "3.0.1", + "name": "Modified Attack Complexity", + "definition": "This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. ", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MPR": { + "key": "MPR", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "MPR", + "version": "1.0.0", + "name": "Modified Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources." + }, + { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e. requires) privileges that provide significant (e.g. administrative) control over the vulnerable component that could affect component-wide settings and files." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e. requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "cvss", + "key": "MPR", + "version": "1.0.1", + "name": "Modified Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." + }, + { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "H": { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MUI": { + "key": "MUI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "MUI", + "version": "1.0.0", + "name": "Modified User Interaction", + "definition": "This metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "R", + "name": "Required", + "definition": "Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited." + }, + { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any user." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "R": { + "key": "R", + "name": "Required", + "definition": "Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any user." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "MUI", + "version": "2.0.0", + "name": "Modified User Interaction", + "definition": "This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "A", + "name": "Active", + "definition": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." + }, + { + "key": "P", + "name": "Passive", + "definition": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." + }, + { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "A": { + "key": "A", + "name": "Active", + "definition": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." + }, + "P": { + "key": "P", + "name": "Passive", + "definition": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MS": { + "key": "MS", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "MS", + "version": "1.0.0", + "name": "Modified Scope", + "definition": "the ability for a vulnerability in one software component to impact resources beyond its means, or privileges", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unchanged", + "definition": "An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same." + }, + { + "key": "C", + "name": "Changed", + "definition": "An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "U": { + "key": "U", + "name": "Unchanged", + "definition": "An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same." + }, + "C": { + "key": "C", + "name": "Changed", + "definition": "An exploited vulnerability can affect resources beyond the authorization privileges intended by the vulnerable component. In this case the vulnerable component and the impacted component are different." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MC": { + "key": "MC", + "versions": { + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "MC", + "version": "2.0.0", + "name": "Modified Confidentiality Impact", + "definition": "This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MI": { + "key": "MI", + "versions": { + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "MI", + "version": "2.0.0", + "name": "Modified Integrity Impact", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to the integrity of the system." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. The data modification does not have a direct, serious impact on the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no impact to the integrity of the system." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. The data modification does not have a direct, serious impact on the impacted component." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MA": { + "key": "MA", + "versions": { + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "cvss", + "key": "MA", + "version": "2.0.0", + "name": "Modified Availability Impact", + "definition": "This metric measures the impact to availability of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to the availability of the system." + }, + { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no impact to the availability of the system." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MAT": { + "key": "MAT", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "MAT", + "version": "1.0.0", + "name": "Modified Attack Requirements", + "definition": "This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Present", + "definition": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + }, + { + "key": "N", + "name": "None", + "definition": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "P": { + "key": "P", + "name": "Present", + "definition": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + }, + "N": { + "key": "N", + "name": "None", + "definition": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MVC": { + "key": "MVC", + "versions": { + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "MVC", + "version": "3.0.0", + "name": "Modified Confidentiality Impact to the Vulnerable System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MVI": { + "key": "MVI", + "versions": { + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "MVI", + "version": "3.0.0", + "name": "Modified Integrity Impact to the Vulnerable System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MVA": { + "key": "MVA", + "versions": { + "3.0.0": { + "version": "3.0.0", + "obj": { + "namespace": "cvss", + "key": "MVA", + "version": "3.0.0", + "name": "Modified Availability Impact to the Vulnerable System", + "definition": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + }, + "MSC": { + "key": "MSC", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "MSC", + "version": "1.0.0", + "name": "Modified Confidentiality Impact to the Subsequent System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + }, + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "cvss", + "key": "MSC", + "version": "1.0.1", + "name": "Modified Confidentiality Impact to the Subsequent System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + }, + { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + "H": { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + }, + "X": { + "key": "X", + "name": "Not Defined", + "definition": "This metric value is not defined. See CVSS documentation for details." + } + } + } + } + } + } + }, + "nist#800-30": { + "namespace": "nist#800-30", + "keys": { + "P_5X": { + "key": "P_5X", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "nist#800-30", + "key": "P_5X", + "version": "1.0.0", + "name": "Probability Scale in 5 weighted levels, ascending", + "definition": "A probability scale with finer resolution at both extremes, based on NIST SP 800-30 Rev. 1 Appendix G", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "VL", + "name": "Very Low", + "definition": "0% <= Probability < 5%. Highly unlikely." + }, + { + "key": "L", + "name": "Low", + "definition": "5% <= Probability < 21%. Unlikely." + }, + { + "key": "M", + "name": "Moderate", + "definition": "21% <= Probability < 80%. Somewhat likely." + }, + { + "key": "H", + "name": "High", + "definition": "80% <= Probability < 96%. Highly likely." + }, + { + "key": "VH", + "name": "Very High", + "definition": "96% <= Probability <= 100%. Almost certain." + } + ] + }, + "values": { + "VL": { + "key": "VL", + "name": "Very Low", + "definition": "0% <= Probability < 5%. Highly unlikely." + }, + "L": { + "key": "L", + "name": "Low", + "definition": "5% <= Probability < 21%. Unlikely." + }, + "M": { + "key": "M", + "name": "Moderate", + "definition": "21% <= Probability < 80%. Somewhat likely." + }, + "H": { + "key": "H", + "name": "High", + "definition": "80% <= Probability < 96%. Highly likely." + }, + "VH": { + "key": "VH", + "name": "Very High", + "definition": "96% <= Probability <= 100%. Almost certain." + } + } + } + } + } + } + }, + "ssvc": { + "namespace": "ssvc", + "keys": { + "V": { + "key": "V", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "V", + "version": "1.0.0", + "name": "Virulence", + "definition": "The speed at which the vulnerability can be exploited.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "S", + "name": "Slow", + "definition": "Steps 1-4 of the kill chain cannot be reliably automated for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation." + }, + { + "key": "R", + "name": "Rapid", + "definition": "Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows remote code execution or command injection, the default response should be rapid." + } + ] + }, + "values": { + "S": { + "key": "S", + "name": "Slow", + "definition": "Steps 1-4 of the kill chain cannot be reliably automated for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation." + }, + "R": { + "key": "R", + "name": "Rapid", + "definition": "Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows remote code execution or command injection, the default response should be rapid." + } + } + } + } + }, + "A": { + "key": "A", + "versions": { + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "ssvc", + "key": "A", + "version": "2.0.0", + "name": "Automatable", + "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + "Y": { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + } + } + } + }, + "CS": { + "key": "CS", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "CS", + "version": "1.0.0", + "name": "Critical Software", + "definition": "Denotes whether a system meets a critical software definition.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "System does not meet a critical software definition." + }, + { + "key": "Y", + "name": "Yes", + "definition": "System meets a critical software definition." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "No", + "definition": "System does not meet a critical software definition." + }, + "Y": { + "key": "Y", + "name": "Yes", + "definition": "System meets a critical software definition." + } + } + } + } + }, + "E": { + "key": "E", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "E", + "version": "1.0.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "PoC", + "definition": "One of the following cases is true: (1) private evidence of exploitation is attested but not shared; (2) widespread hearsay attests to exploitation; (3) typical public PoC in places such as Metasploit or ExploitDB; or (4) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + "P": { + "key": "P", + "name": "PoC", + "definition": "One of the following cases is true: (1) private evidence of exploitation is attested but not shared; (2) widespread hearsay attests to exploitation; (3) typical public PoC in places such as Metasploit or ExploitDB; or (4) the vulnerability has a well-known method of exploitation." + }, + "A": { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + } + }, + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + "P": { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + "A": { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + } + } + } + }, + "HVA": { + "key": "HVA", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "HVA", + "version": "1.0.0", + "name": "High Value Asset", + "definition": "Denotes whether a system meets a high value asset definition.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "System does not meet a high value asset definition." + }, + { + "key": "Y", + "name": "Yes", + "definition": "System meets a high value asset definition." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "No", + "definition": "System does not meet a high value asset definition." + }, + "Y": { + "key": "Y", + "name": "Yes", + "definition": "System meets a high value asset definition." + } + } + } + } + }, + "MWI": { + "key": "MWI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "MWI", + "version": "1.0.0", + "name": "Mission and Well-Being Impact", + "definition": "Mission and Well-Being Impact is a combination of Mission Prevalence and Public Well-Being Impact.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Mission Prevalence:Minimal AND Public Well-Being Impact:Minimal" + }, + { + "key": "M", + "name": "Medium", + "definition": "Mission Prevalence:Support AND Public Well-Being Impact:(Minimal OR Material)" + }, + { + "key": "H", + "name": "High", + "definition": "Mission Prevalence:Essential OR Public Well-Being Impact:(Irreversible)" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Mission Prevalence:Minimal AND Public Well-Being Impact:Minimal" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "Mission Prevalence:Support AND Public Well-Being Impact:(Minimal OR Material)" + }, + "H": { + "key": "H", + "name": "High", + "definition": "Mission Prevalence:Essential OR Public Well-Being Impact:(Irreversible)" + } + } + } + } + }, + "HI": { + "key": "HI", + "versions": { + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "ssvc", + "key": "HI", + "version": "2.0.0", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(None OR Minor) AND Mission Impact:(None OR Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:(None OR Minor) AND Mission Impact:MEF Failure) OR (Safety Impact:Major AND Mission Impact:(None OR Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Hazardous AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Major AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(None OR Minor) AND Mission Impact:(None OR Degraded OR Crippled)" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:(None OR Minor) AND Mission Impact:MEF Failure) OR (Safety Impact:Major AND Mission Impact:(None OR Degraded OR Crippled))" + }, + "H": { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Hazardous AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Major AND Mission Impact:MEF Failure)" + }, + "VH": { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + } + }, + "2.0.1": { + "version": "2.0.1", + "obj": { + "namespace": "ssvc", + "key": "HI", + "version": "2.0.1", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(None OR Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(None OR Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(None OR Degraded OR Crippled)" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(None OR Degraded OR Crippled))" + }, + "H": { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + "VH": { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + } + }, + "2.0.2": { + "version": "2.0.2", + "obj": { + "namespace": "ssvc", + "key": "HI", + "version": "2.0.2", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)" + }, + "M": { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))" + }, + "H": { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + "VH": { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + } + } + } + }, + "MI": { + "key": "MI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "MI", + "version": "1.0.0", + "name": "Mission Impact", + "definition": "Impact on Mission Essential Functions of the Organization", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "Little to no impact" + }, + { + "key": "NED", + "name": "Non-Essential Degraded", + "definition": "Degradation of non-essential functions; chronic degradation would eventually harm essential functions" + }, + { + "key": "MSC", + "name": "MEF Support Crippled", + "definition": "Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + { + "key": "MEF", + "name": "MEF Failure", + "definition": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + }, + { + "key": "MF", + "name": "Mission Failure", + "definition": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "Little to no impact" + }, + "NED": { + "key": "NED", + "name": "Non-Essential Degraded", + "definition": "Degradation of non-essential functions; chronic degradation would eventually harm essential functions" + }, + "MSC": { + "key": "MSC", + "name": "MEF Support Crippled", + "definition": "Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + "MEF": { + "key": "MEF", + "name": "MEF Failure", + "definition": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + }, + "MF": { + "key": "MF", + "name": "Mission Failure", + "definition": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "ssvc", + "key": "MI", + "version": "2.0.0", + "name": "Mission Impact", + "definition": "Impact on Mission Essential Functions of the Organization", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Degraded", + "definition": "Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions" + }, + { + "key": "MSC", + "name": "MEF Support Crippled", + "definition": "Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + { + "key": "MEF", + "name": "MEF Failure", + "definition": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + }, + { + "key": "MF", + "name": "Mission Failure", + "definition": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + } + ] + }, + "values": { + "D": { + "key": "D", + "name": "Degraded", + "definition": "Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions" + }, + "MSC": { + "key": "MSC", + "name": "MEF Support Crippled", + "definition": "Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + "MEF": { + "key": "MEF", + "name": "MEF Failure", + "definition": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + }, + "MF": { + "key": "MF", + "name": "Mission Failure", + "definition": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + } + } + } + } + }, + "PWI": { + "key": "PWI", + "versions": { + "1.1.0": { + "version": "1.1.0", + "obj": { + "namespace": "ssvc", + "key": "PWI", + "version": "1.1.0", + "name": "Public Well-Being Impact", + "definition": "A coarse-grained representation of impact to public well-being.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "The effect is below the threshold for all aspects described in material. " + }, + { + "key": "MA", + "name": "Material", + "definition": "Any one or more of these conditions hold. Physical harm: Does one or more of the following: (a) Causes physical distress or injury to system users. (b) Introduces occupational safety hazards. (c) Reduces and/or results in failure of cyber-physical system safety margins. Environment: Major externalities (property damage, environmental damage, etc.) are imposed on other parties. Financial: Financial losses likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to necessitate counseling or therapy, impact populations of people. " + }, + { + "key": "I", + "name": "Irreversible", + "definition": "Any one or more of these conditions hold. Physical harm: One or both of the following are true: (a) Multiple fatalities are likely.(b) The cyber-physical system, of which the vulnerable componen is a part, is likely lost or destroyed. Environment: Extreme or serious externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) are imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software are destabilized and potentially collapse. Psychological: N/A " + } + ] + }, + "values": { + "M": { + "key": "M", + "name": "Minimal", + "definition": "The effect is below the threshold for all aspects described in material. " + }, + "MA": { + "key": "MA", + "name": "Material", + "definition": "Any one or more of these conditions hold. Physical harm: Does one or more of the following: (a) Causes physical distress or injury to system users. (b) Introduces occupational safety hazards. (c) Reduces and/or results in failure of cyber-physical system safety margins. Environment: Major externalities (property damage, environmental damage, etc.) are imposed on other parties. Financial: Financial losses likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to necessitate counseling or therapy, impact populations of people. " + }, + "I": { + "key": "I", + "name": "Irreversible", + "definition": "Any one or more of these conditions hold. Physical harm: One or both of the following are true: (a) Multiple fatalities are likely.(b) The cyber-physical system, of which the vulnerable componen is a part, is likely lost or destroyed. Environment: Extreme or serious externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) are imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software are destabilized and potentially collapse. Psychological: N/A " + } + } + } + } + }, + "PSI": { + "key": "PSI", + "versions": { + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.0", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:(None OR Minor)" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Major OR Hazardous OR Catastrophic)" + } + ] + }, + "values": { + "M": { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:(None OR Minor)" + }, + "S": { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Major OR Hazardous OR Catastrophic)" + } + } + }, + "2.0.1": { + "version": "2.0.1", + "obj": { + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.1", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:Negligible" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + } + ] + }, + "values": { + "M": { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:Negligible" + }, + "S": { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + } + } + } + } + }, + "PVA": { + "key": "PVA", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "PVA", + "version": "1.0.0", + "name": "Public Value Added", + "definition": "How much value would a publication from the coordinator benefit the broader community?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Limited", + "definition": "Minimal value added to the existing public information because existing information is already high quality and in multiple outlets." + }, + { + "key": "A", + "name": "Ampliative", + "definition": "Amplifies and/or augments the existing public information about the vulnerability, for example, adds additional detail, addresses or corrects errors in other public information, draws further attention to the vulnerability, etc." + }, + { + "key": "P", + "name": "Precedence", + "definition": "The publication would be the first publicly available, or be coincident with the first publicly available." + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Limited", + "definition": "Minimal value added to the existing public information because existing information is already high quality and in multiple outlets." + }, + "A": { + "key": "A", + "name": "Ampliative", + "definition": "Amplifies and/or augments the existing public information about the vulnerability, for example, adds additional detail, addresses or corrects errors in other public information, draws further attention to the vulnerability, etc." + }, + "P": { + "key": "P", + "name": "Precedence", + "definition": "The publication would be the first publicly available, or be coincident with the first publicly available." + } + } + } + } + }, + "RC": { + "key": "RC", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "RC", + "version": "1.0.0", + "name": "Report Credibility", + "definition": "Is the report credible?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "NC", + "name": "Not Credible", + "definition": "The report is not credible." + }, + { + "key": "C", + "name": "Credible", + "definition": "The report is credible." + } + ] + }, + "values": { + "NC": { + "key": "NC", + "name": "Not Credible", + "definition": "The report is not credible." + }, + "C": { + "key": "C", + "name": "Credible", + "definition": "The report is credible." + } + } + } + } + }, + "RP": { + "key": "RP", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "RP", + "version": "1.0.0", + "name": "Report Public", + "definition": "Is a viable report of the details of the vulnerability already publicly available?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "Y", + "name": "Yes", + "definition": "A public report of the vulnerability exists." + }, + { + "key": "N", + "name": "No", + "definition": "No public report of the vulnerability exists." + } + ] + }, + "values": { + "Y": { + "key": "Y", + "name": "Yes", + "definition": "A public report of the vulnerability exists." + }, + "N": { + "key": "N", + "name": "No", + "definition": "No public report of the vulnerability exists." + } + } + } + } + }, + "SI": { + "key": "SI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "SI", + "version": "1.0.0", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "The effect is below the threshold for all aspects described in Minor." + }, + { + "key": "M", + "name": "Minor", + "definition": "Any one or more of these conditions hold. Physical harm: Physical discomfort for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. System resiliency: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. Environment: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. Financial Financial losses, which are not readily absorbable, to multiple persons. Psychological: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "J", + "name": "Major", + "definition": "Any one or more of these conditions hold. Physical harm: Physical distress and injuries for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. System resiliency: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. Environment: Major externalities (property damage, environmental damage, etc.) imposed on other parties. Financial: Financial losses that likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "H", + "name": "Hazardous", + "definition": "Any one or more of these conditions hold. Physical harm: Serious or fatal injuries, where fatalities are plausibly preventable via emergency services or other measures. Operator resiliency: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. System resiliency: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. Environment: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. Financial: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. Psychological: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. Physical harm: Multiple immediate fatalities (Emergency response probably cannot save the victims.) Operator resiliency: Operator incapacitated (includes fatality or otherwise incapacitated). System resiliency: Total loss of whole cyber-physical system, of which the software is a part. Environment: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software collapse. Psychological: N/A." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "None", + "definition": "The effect is below the threshold for all aspects described in Minor." + }, + "M": { + "key": "M", + "name": "Minor", + "definition": "Any one or more of these conditions hold. Physical harm: Physical discomfort for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. System resiliency: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. Environment: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. Financial Financial losses, which are not readily absorbable, to multiple persons. Psychological: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + "J": { + "key": "J", + "name": "Major", + "definition": "Any one or more of these conditions hold. Physical harm: Physical distress and injuries for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. System resiliency: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. Environment: Major externalities (property damage, environmental damage, etc.) imposed on other parties. Financial: Financial losses that likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + "H": { + "key": "H", + "name": "Hazardous", + "definition": "Any one or more of these conditions hold. Physical harm: Serious or fatal injuries, where fatalities are plausibly preventable via emergency services or other measures. Operator resiliency: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. System resiliency: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. Environment: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. Financial: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. Psychological: N/A." + }, + "C": { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. Physical harm: Multiple immediate fatalities (Emergency response probably cannot save the victims.) Operator resiliency: Operator incapacitated (includes fatality or otherwise incapacitated). System resiliency: Total loss of whole cyber-physical system, of which the software is a part. Environment: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software collapse. Psychological: N/A." + } + } + }, + "2.0.0": { + "version": "2.0.0", + "obj": { + "namespace": "ssvc", + "key": "SI", + "version": "2.0.0", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability. (based on IEC 61508)", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Minor injuries at worst (IEC 61508 Negligible).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard.
- *System resiliency*: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation.
- *Environment*: Minor externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses, which are not readily absorbable, to multiple persons.
- *Psychological*: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Major injuries to one or more persons (IEC 61508 Marginal).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard.
- *System resiliency*: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation.
- *Environment*: Major externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses that likely lead to bankruptcy of multiple persons.
- *Psychological*: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Loss of life (IEC 61508 Critical).
- *Operator resiliency*: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly.
- *System resiliency*: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact.
- *Environment*: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties.
- *Financial*: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state.
- *Psychological*: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Multiple loss of life (IEC 61508 Catastrophic).
- *Operator resiliency*: Operator incapacitated (includes fatality or otherwise incapacitated).
- *System resiliency*: Total loss of whole cyber-physical system, of which the software is a part.
- *Environment*: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties.
- *Financial*: Social systems (elections, financial grid, etc.) supported by the software collapse.
- *Psychological*: N/A." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Minor injuries at worst (IEC 61508 Negligible).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard.
- *System resiliency*: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation.
- *Environment*: Minor externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses, which are not readily absorbable, to multiple persons.
- *Psychological*: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + "M": { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Major injuries to one or more persons (IEC 61508 Marginal).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard.
- *System resiliency*: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation.
- *Environment*: Major externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses that likely lead to bankruptcy of multiple persons.
- *Psychological*: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + "R": { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Loss of life (IEC 61508 Critical).
- *Operator resiliency*: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly.
- *System resiliency*: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact.
- *Environment*: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties.
- *Financial*: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state.
- *Psychological*: N/A." + }, + "C": { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold.

- *Physical harm*: Multiple loss of life (IEC 61508 Catastrophic).
- *Operator resiliency*: Operator incapacitated (includes fatality or otherwise incapacitated).
- *System resiliency*: Total loss of whole cyber-physical system, of which the software is a part.
- *Environment*: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties.
- *Financial*: Social systems (elections, financial grid, etc.) supported by the software collapse.
- *Psychological*: N/A." + } + } + }, + "2.0.1": { + "version": "2.0.1", + "obj": { + "namespace": "ssvc", + "key": "SI", + "version": "2.0.1", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability. (based on IEC 61508 with modifications)", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold. **Physical harm**: Minor injuries at worst (IEC 61508 Negligible). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. **System resiliency**: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. **Environment**: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses, which are not readily absorbable, to multiple persons. **Psychological**: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold. **Physical harm**: Major injuries to one or more persons (IEC 61508 Marginal). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. **System resiliency**: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. **Environment**: Major externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses that likely lead to bankruptcy of multiple persons. **Psychological**: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold. **Physical harm**: Loss of life (IEC 61508 Critical). **Operator resiliency**: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. **System resiliency**: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. **Environment**: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. **Financial**: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. **Psychological**: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. **Physical harm**: Multiple loss of life (IEC 61508 Catastrophic). **Operator resiliency**: Operator incapacitated (includes fatality or otherwise incapacitated). **System resiliency**: Total loss of whole cyber-physical system, of which the software is a part. **Environment**: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. **Financial**: Social systems (elections, financial grid, etc.) supported by the software collapse. **Psychological**: N/A." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold. **Physical harm**: Minor injuries at worst (IEC 61508 Negligible). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. **System resiliency**: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. **Environment**: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses, which are not readily absorbable, to multiple persons. **Psychological**: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + "M": { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold. **Physical harm**: Major injuries to one or more persons (IEC 61508 Marginal). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. **System resiliency**: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. **Environment**: Major externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses that likely lead to bankruptcy of multiple persons. **Psychological**: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + "R": { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold. **Physical harm**: Loss of life (IEC 61508 Critical). **Operator resiliency**: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. **System resiliency**: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. **Environment**: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. **Financial**: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. **Psychological**: N/A." + }, + "C": { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. **Physical harm**: Multiple loss of life (IEC 61508 Catastrophic). **Operator resiliency**: Operator incapacitated (includes fatality or otherwise incapacitated). **System resiliency**: Total loss of whole cyber-physical system, of which the software is a part. **Environment**: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. **Financial**: Social systems (elections, financial grid, etc.) supported by the software collapse. **Psychological**: N/A." + } + } + } + } + }, + "SC": { + "key": "SC", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "SC", + "version": "1.0.0", + "name": "Supplier Cardinality", + "definition": "How many suppliers are responsible for the vulnerable component and its remediation or mitigation plan?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "O", + "name": "One", + "definition": "There is only one supplier of the vulnerable component." + }, + { + "key": "M", + "name": "Multiple", + "definition": "There are multiple suppliers of the vulnerable component." + } + ] + }, + "values": { + "O": { + "key": "O", + "name": "One", + "definition": "There is only one supplier of the vulnerable component." + }, + "M": { + "key": "M", + "name": "Multiple", + "definition": "There are multiple suppliers of the vulnerable component." + } + } + } + } + }, + "SCON": { + "key": "SCON", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "SCON", + "version": "1.0.0", + "name": "Supplier Contacted", + "definition": "Has the reporter made a good-faith effort to contact the supplier of the vulnerable component using a quality contact method?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "The supplier has not been contacted." + }, + { + "key": "Y", + "name": "Yes", + "definition": "The supplier has been contacted." + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "No", + "definition": "The supplier has not been contacted." + }, + "Y": { + "key": "Y", + "name": "Yes", + "definition": "The supplier has been contacted." + } + } + } + } + }, + "SE": { + "key": "SE", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "SE", + "version": "1.0.0", + "name": "Supplier Engagement", + "definition": "Is the supplier responding to the reporter’s contact effort and actively participating in the coordination effort?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "A", + "name": "Active", + "definition": "The supplier is responding to the reporter’s contact effort and actively participating in the coordination effort." + }, + { + "key": "U", + "name": "Unresponsive", + "definition": "The supplier is not responding to the reporter’s contact effort and not actively participating in the coordination effort." + } + ] + }, + "values": { + "A": { + "key": "A", + "name": "Active", + "definition": "The supplier is responding to the reporter’s contact effort and actively participating in the coordination effort." + }, + "U": { + "key": "U", + "name": "Unresponsive", + "definition": "The supplier is not responding to the reporter’s contact effort and not actively participating in the coordination effort." + } + } + } + } + }, + "SINV": { + "key": "SINV", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "SINV", + "version": "1.0.0", + "name": "Supplier Involvement", + "definition": "What is the state of the supplier’s work on addressing the vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "FR", + "name": "Fix Ready", + "definition": "The supplier has provided a patch or fix." + }, + { + "key": "C", + "name": "Cooperative", + "definition": "The supplier is actively generating a patch or fix; they may or may not have provided a mitigation or work-around in the mean time." + }, + { + "key": "UU", + "name": "Uncooperative/Unresponsive", + "definition": "The supplier has not responded, declined to generate a remediation, or no longer exists." + } + ] + }, + "values": { + "FR": { + "key": "FR", + "name": "Fix Ready", + "definition": "The supplier has provided a patch or fix." + }, + "C": { + "key": "C", + "name": "Cooperative", + "definition": "The supplier is actively generating a patch or fix; they may or may not have provided a mitigation or work-around in the mean time." + }, + "UU": { + "key": "UU", + "name": "Uncooperative/Unresponsive", + "definition": "The supplier has not responded, declined to generate a remediation, or no longer exists." + } + } + } + } + }, + "EXP": { + "key": "EXP", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "EXP", + "version": "1.0.0", + "name": "System Exposure", + "definition": "The Accessible Attack Surface of the Affected System or Service", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "S", + "name": "Small", + "definition": "Local service or program; highly controlled network" + }, + { + "key": "C", + "name": "Controlled", + "definition": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + { + "key": "U", + "name": "Unavoidable", + "definition": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + ] + }, + "values": { + "S": { + "key": "S", + "name": "Small", + "definition": "Local service or program; highly controlled network" + }, + "C": { + "key": "C", + "name": "Controlled", + "definition": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + "U": { + "key": "U", + "name": "Unavoidable", + "definition": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + } + }, + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "ssvc", + "key": "EXP", + "version": "1.0.1", + "name": "System Exposure", + "definition": "The Accessible Attack Surface of the Affected System or Service", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "S", + "name": "Small", + "definition": "Local service or program; highly controlled network" + }, + { + "key": "C", + "name": "Controlled", + "definition": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + { + "key": "O", + "name": "Open", + "definition": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + ] + }, + "values": { + "S": { + "key": "S", + "name": "Small", + "definition": "Local service or program; highly controlled network" + }, + "C": { + "key": "C", + "name": "Controlled", + "definition": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + "O": { + "key": "O", + "name": "Open", + "definition": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + } + } + } + }, + "TI": { + "key": "TI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "TI", + "version": "1.0.0", + "name": "Technical Impact", + "definition": "The technical impact of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Partial", + "definition": "The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control." + }, + { + "key": "T", + "name": "Total", + "definition": "The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability." + } + ] + }, + "values": { + "P": { + "key": "P", + "name": "Partial", + "definition": "The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control." + }, + "T": { + "key": "T", + "name": "Total", + "definition": "The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability." + } + } + } + } + }, + "U": { + "key": "U", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "U", + "version": "1.0.0", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Virulence:Slow and Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "Virulence:Rapid and Value Density:Diffuse OR Virulence:Slow and Value Density:Concentrated" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Virulence:Rapid and Value Density:Concentrated" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Laborious", + "definition": "Virulence:Slow and Value Density:Diffuse" + }, + "E": { + "key": "E", + "name": "Efficient", + "definition": "Virulence:Rapid and Value Density:Diffuse OR Virulence:Slow and Value Density:Concentrated" + }, + "S": { + "key": "S", + "name": "Super Effective", + "definition": "Virulence:Rapid and Value Density:Concentrated" + } + } + }, + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "ssvc", + "key": "U", + "version": "1.0.1", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + ] + }, + "values": { + "L": { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + "E": { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + "S": { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + } + } + } + }, + "VD": { + "key": "VD", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "VD", + "version": "1.0.0", + "name": "Value Density", + "definition": "The concentration of value in the target", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Diffuse", + "definition": "The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small." + }, + { + "key": "C", + "name": "Concentrated", + "definition": "The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users." + } + ] + }, + "values": { + "D": { + "key": "D", + "name": "Diffuse", + "definition": "The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small." + }, + "C": { + "key": "C", + "name": "Concentrated", + "definition": "The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users." + } + } + } + } + }, + "COORDINATE": { + "key": "COORDINATE", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "COORDINATE", + "version": "1.0.0", + "name": "Decline, Track, Coordinate", + "definition": "The coordinate outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Decline", + "definition": "Decline" + }, + { + "key": "T", + "name": "Track", + "definition": "Track" + }, + { + "key": "C", + "name": "Coordinate", + "definition": "Coordinate" + } + ] + }, + "values": { + "D": { + "key": "D", + "name": "Decline", + "definition": "Decline" + }, + "T": { + "key": "T", + "name": "Track", + "definition": "Track" + }, + "C": { + "key": "C", + "name": "Coordinate", + "definition": "Coordinate" + } + } + }, + "1.0.1": { + "version": "1.0.1", + "obj": { + "namespace": "ssvc", + "key": "COORDINATE", + "version": "1.0.1", + "name": "Decline, Track, Coordinate", + "definition": "The coordinate outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Decline", + "definition": "Do not act on the report." + }, + { + "key": "T", + "name": "Track", + "definition": "Receive information about the vulnerability and monitor for status changes but do not take any overt actions." + }, + { + "key": "C", + "name": "Coordinate", + "definition": "Take action on the report." + } + ] + }, + "values": { + "D": { + "key": "D", + "name": "Decline", + "definition": "Do not act on the report." + }, + "T": { + "key": "T", + "name": "Track", + "definition": "Receive information about the vulnerability and monitor for status changes but do not take any overt actions." + }, + "C": { + "key": "C", + "name": "Coordinate", + "definition": "Take action on the report." + } + } + } + } + }, + "DSOI": { + "key": "DSOI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "DSOI", + "version": "1.0.0", + "name": "Defer, Scheduled, Out-of-Cycle, Immediate", + "definition": "The original SSVC outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Defer", + "definition": "Defer" + }, + { + "key": "S", + "name": "Scheduled", + "definition": "Scheduled" + }, + { + "key": "O", + "name": "Out-of-Cycle", + "definition": "Out-of-Cycle" + }, + { + "key": "I", + "name": "Immediate", + "definition": "Immediate" + } + ] + }, + "values": { + "D": { + "key": "D", + "name": "Defer", + "definition": "Defer" + }, + "S": { + "key": "S", + "name": "Scheduled", + "definition": "Scheduled" + }, + "O": { + "key": "O", + "name": "Out-of-Cycle", + "definition": "Out-of-Cycle" + }, + "I": { + "key": "I", + "name": "Immediate", + "definition": "Immediate" + } + } + } + } + }, + "PUBLISH": { + "key": "PUBLISH", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "PUBLISH", + "version": "1.0.0", + "name": "Publish, Do Not Publish", + "definition": "The publish outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Do Not Publish", + "definition": "Do Not Publish" + }, + { + "key": "P", + "name": "Publish", + "definition": "Publish" + } + ] + }, + "values": { + "N": { + "key": "N", + "name": "Do Not Publish", + "definition": "Do Not Publish" + }, + "P": { + "key": "P", + "name": "Publish", + "definition": "Publish" + } + } + } + } + } + } + }, + "x_com.yahooinc#prioritized-risk-remediation": { + "namespace": "x_com.yahooinc#prioritized-risk-remediation", + "keys": { + "PARANOIDS": { + "key": "PARANOIDS", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "x_com.yahooinc#prioritized-risk-remediation", + "key": "PARANOIDS", + "version": "1.0.0", + "name": "theParanoids", + "definition": "PrioritizedRiskRemediation outcome group based on TheParanoids.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "5", + "name": "Track 5", + "definition": "Track" + }, + { + "key": "4", + "name": "Track Closely 4", + "definition": "Track Closely" + }, + { + "key": "3", + "name": "Attend 3", + "definition": "Attend" + }, + { + "key": "2", + "name": "Attend 2", + "definition": "Attend" + }, + { + "key": "1", + "name": "Act 1", + "definition": "Act" + }, + { + "key": "0", + "name": "Act ASAP 0", + "definition": "Act ASAP" + } + ] + }, + "values": { + "5": { + "key": "5", + "name": "Track 5", + "definition": "Track" + }, + "4": { + "key": "4", + "name": "Track Closely 4", + "definition": "Track Closely" + }, + "3": { + "key": "3", + "name": "Attend 3", + "definition": "Attend" + }, + "2": { + "key": "2", + "name": "Attend 2", + "definition": "Attend" + }, + "1": { + "key": "1", + "name": "Act 1", + "definition": "Act" + }, + "0": { + "key": "0", + "name": "Act ASAP 0", + "definition": "Act ASAP" + } + } + } + } + } + } + } + } + }, + "DecisionTable": { + "type": "DecisionTable", + "namespaces": { + "cisa": { + "namespace": "cisa", + "keys": { + "DT_CO": { + "key": "DT_CO", + "versions": { + "2.0.3": { + "version": "2.0.3", + "obj": { + "namespace": "cisa", + "key": "DT_CO", + "version": "2.0.3", + "name": "CISA Coordinator", + "definition": "CISA Coordinator decision table for SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:E:1.1.0": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "ssvc:A:2.0.0": { + "namespace": "ssvc", + "key": "A", + "version": "2.0.0", + "name": "Automatable", + "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + ] + }, + "ssvc:TI:1.0.0": { + "namespace": "ssvc", + "key": "TI", + "version": "1.0.0", + "name": "Technical Impact", + "definition": "The technical impact of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Partial", + "definition": "The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control." + }, + { + "key": "T", + "name": "Total", + "definition": "The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability." + } + ] + }, + "ssvc:MWI:1.0.0": { + "namespace": "ssvc", + "key": "MWI", + "version": "1.0.0", + "name": "Mission and Well-Being Impact", + "definition": "Mission and Well-Being Impact is a combination of Mission Prevalence and Public Well-Being Impact.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Mission Prevalence:Minimal AND Public Well-Being Impact:Minimal" + }, + { + "key": "M", + "name": "Medium", + "definition": "Mission Prevalence:Support AND Public Well-Being Impact:(Minimal OR Material)" + }, + { + "key": "H", + "name": "High", + "definition": "Mission Prevalence:Essential OR Public Well-Being Impact:(Irreversible)" + } + ] + }, + "cisa:CISA:1.1.0": { + "namespace": "cisa", + "key": "CISA", + "version": "1.1.0", + "name": "CISA Levels", + "definition": "The CISA outcome group. CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Track*, Attend, and Act.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "T", + "name": "Track", + "definition": "The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines." + }, + { + "key": "T*", + "name": "Track*", + "definition": "The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines." + }, + { + "key": "AT", + "name": "Attend", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines." + }, + { + "key": "AC", + "name": "Act", + "definition": "The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible." + } + ] + } + }, + "outcome": "cisa:CISA:1.1.0", + "mapping": [ + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "T*" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "T*" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T*" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T*" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "T" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "N", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AC" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "P", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AC" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "L", + "cisa:CISA:1.1.0": "AT" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "M", + "cisa:CISA:1.1.0": "AC" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:A:2.0.0": "Y", + "ssvc:TI:1.0.0": "T", + "ssvc:MWI:1.0.0": "H", + "cisa:CISA:1.1.0": "AC" + } + ] + } + } + } + } + } + }, + "cvss": { + "namespace": "cvss", + "keys": { + "DT_CVSS_EQ5": { + "key": "DT_CVSS_EQ5", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "DT_CVSS_EQ5", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 5", + "definition": "CVSS Equivalence Set 5 Decision Table", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:E_NoX:2.0.0": { + "namespace": "cvss", + "key": "E_NoX", + "version": "2.0.0", + "name": "Exploit Maturity (without Not Defined)", + "definition": "This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "U", + "name": "Unreported", + "definition": "Based on available threat intelligence each of the following must apply: No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)" + }, + { + "key": "P", + "name": "Proof-of-Concept", + "definition": "Based on available threat intelligence each of the following must apply: Proof-of-concept exploit code is publicly available No knowledge of reported attempts to exploit this vulnerability No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)" + }, + { + "key": "A", + "name": "Attacked", + "definition": "Based on available threat intelligence either of the following must apply: Attacks targeting this vulnerability (attempted or successful) have been reported Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)" + } + ] + }, + "cvss:EQ5:1.0.0": { + "namespace": "cvss", + "key": "EQ5", + "version": "1.0.0", + "name": "Equivalence Set 5", + "definition": "E with 3 levels specified in Table 28", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: E:U" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: E:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: E:A" + } + ] + } + }, + "outcome": "cvss:EQ5:1.0.0", + "mapping": [ + { + "cvss:E_NoX:2.0.0": "U", + "cvss:EQ5:1.0.0": "L" + }, + { + "cvss:E_NoX:2.0.0": "P", + "cvss:EQ5:1.0.0": "M" + }, + { + "cvss:E_NoX:2.0.0": "A", + "cvss:EQ5:1.0.0": "H" + } + ] + } + } + } + }, + "DT_CVSS4_EQ4": { + "key": "DT_CVSS4_EQ4", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "DT_CVSS4_EQ4", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 4", + "definition": "This decision table models equivalence set 4 from CVSS v4.", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:SC:1.0.0": { + "namespace": "cvss", + "key": "SC", + "version": "1.0.0", + "name": "Confidentiality Impact to the Subsequent System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact." + } + ] + }, + "cvss:MSI_NoX:1.0.1": { + "namespace": "cvss", + "key": "MSI_NoX", + "version": "1.0.1", + "name": "Modified Integrity Impact to the Subsequent System (without Not Defined)", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging). The resulting score is greatest when the consequence to the system is highest. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] + }, + "cvss:MSA_NoX:1.0.1": { + "namespace": "cvss", + "key": "MSA_NoX", + "version": "1.0.1", + "name": "Modified Availability Impact to the Subsequent System (without Not Defined)", + "definition": "This metric measures the impact on availability a successful exploit of the vulnerability will have on the Subsequent System. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "There is negligible impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + }, + { + "key": "S", + "name": "Safety", + "definition": "The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited." + } + ] + }, + "cvss:EQ4:1.0.0": { + "namespace": "cvss", + "key": "EQ4", + "version": "1.0.0", + "name": "Equivalence Set 4", + "definition": "SC/SI/SA with 3 levels specified in Table 27", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: MSI:S or MSA:S" + } + ] + } + }, + "outcome": "cvss:EQ4:1.0.0", + "mapping": [ + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "L" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "N", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "N", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "L", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "M" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "L", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "N", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "H", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "H", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "L", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + }, + { + "cvss:SC:1.0.0": "H", + "cvss:MSI_NoX:1.0.1": "S", + "cvss:MSA_NoX:1.0.1": "S", + "cvss:EQ4:1.0.0": "H" + } + ] + } + } + } + }, + "DT_CVSS4_EQ1": { + "key": "DT_CVSS4_EQ1", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "DT_CVSS4_EQ1", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 1", + "definition": "This decision table models equivalence set 1 from CVSS v4. Factors include Attack Vector (AV), Privileges Required (PR), and User Interaction (UI).", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:AV:3.0.1": { + "namespace": "cvss", + "key": "AV", + "version": "3.0.1", + "name": "Attack Vector", + "definition": "This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Physical", + "definition": "The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent." + }, + { + "key": "L", + "name": "Local", + "definition": "The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document)." + }, + { + "key": "A", + "name": "Adjacent", + "definition": "The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone)." + }, + { + "key": "N", + "name": "Network", + "definition": "The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers)." + } + ] + }, + "cvss:PR:1.0.1": { + "namespace": "cvss", + "key": "PR", + "version": "1.0.1", + "name": "Privileges Required", + "definition": "This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker is authorized with (i.e., requires) privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources." + }, + { + "key": "N", + "name": "None", + "definition": "The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack." + } + ] + }, + "cvss:UI:2.0.0": { + "namespace": "cvss", + "key": "UI", + "version": "2.0.0", + "name": "User Interaction", + "definition": "This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "A", + "name": "Active", + "definition": "Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability." + }, + { + "key": "P", + "name": "Passive", + "definition": "Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system." + }, + { + "key": "N", + "name": "None", + "definition": "The vulnerable system can be exploited without interaction from any human user, other than the attacker." + } + ] + }, + "cvss:EQ1:1.0.0": { + "namespace": "cvss", + "key": "EQ1", + "version": "1.0.0", + "name": "Equivalence Set 1", + "definition": "AV/PR/UI with 3 levels specified in Table 24", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: AV:P or not(AV:N or PR:N or UI:N)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: AV:N and PR:N and UI:N" + } + ] + } + }, + "outcome": "cvss:EQ1:1.0.0", + "mapping": [ + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "P", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "L" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "A", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "H", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "L", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "P", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "L", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "A", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "M" + }, + { + "cvss:AV:3.0.1": "N", + "cvss:PR:1.0.1": "N", + "cvss:UI:2.0.0": "N", + "cvss:EQ1:1.0.0": "H" + } + ] + } + } + } + }, + "DT_CVSS4_EQ6": { + "key": "DT_CVSS4_EQ6", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "DT_CVSS4_EQ6", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 6", + "definition": "This decision table models equivalence set 6 from CVSS v4.", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:CR_NoX:1.1.1": { + "namespace": "cvss", + "key": "CR_NoX", + "version": "1.1.1", + "name": "Confidentiality Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "cvss:VC:3.0.0": { + "namespace": "cvss", + "key": "VC", + "version": "3.0.0", + "name": "Confidentiality Impact to the Vulnerable System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + } + ] + }, + "cvss:IR_NoX:1.1.1": { + "namespace": "cvss", + "key": "IR_NoX", + "version": "1.1.1", + "name": "Integrity Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "cvss:VI:3.0.0": { + "namespace": "cvss", + "key": "VI", + "version": "3.0.0", + "name": "Integrity Impact to the Vulnerable System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + } + ] + }, + "cvss:AR_NoX:1.1.1": { + "namespace": "cvss", + "key": "AR_NoX", + "version": "1.1.1", + "name": "Availability Requirement (without Not Defined)", + "definition": "This metric enables the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Availability. This version does not include the Not Defined (X) option.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "M", + "name": "Medium", + "definition": "Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + }, + { + "key": "H", + "name": "High", + "definition": "Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers)." + } + ] + }, + "cvss:VA:3.0.0": { + "namespace": "cvss", + "key": "VA", + "version": "3.0.0", + "name": "Availability Impact to the Vulnerable System", + "definition": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + ] + }, + "cvss:EQ6:1.0.0": { + "namespace": "cvss", + "key": "EQ6", + "version": "1.0.0", + "name": "Equivalence Set 6", + "definition": "VC/VI/VA+CR/CI/CA with 2 levels specified in Table 29", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)" + } + ] + } + }, + "outcome": "cvss:EQ6:1.0.0", + "mapping": [ + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "L" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "N", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "L", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "N", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "L", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "M", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "L", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "M", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "L", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "M", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + }, + { + "cvss:CR_NoX:1.1.1": "H", + "cvss:VC:3.0.0": "H", + "cvss:IR_NoX:1.1.1": "H", + "cvss:VI:3.0.0": "H", + "cvss:AR_NoX:1.1.1": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ6:1.0.0": "H" + } + ] + } + } + } + }, + "DT_CVSS4_EQ3": { + "key": "DT_CVSS4_EQ3", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "DT_CVSS4_EQ3", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 3", + "definition": "This decision table models equivalence set 3 from CVSS v4.", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:VC:3.0.0": { + "namespace": "cvss", + "key": "VC", + "version": "3.0.0", + "name": "Confidentiality Impact to the Vulnerable System", + "definition": "This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of confidentiality within the impacted component." + }, + { + "key": "L", + "name": "Low", + "definition": "There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is constrained. The information disclosure does not cause a direct, serious loss to the impacted component." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server." + } + ] + }, + "cvss:VI:3.0.0": { + "namespace": "cvss", + "key": "VI", + "version": "3.0.0", + "name": "Integrity Impact to the Vulnerable System", + "definition": "This metric measures the impact to integrity of a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no loss of integrity within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is a total loss of integrity, or a complete loss of protection." + } + ] + }, + "cvss:VA:3.0.0": { + "namespace": "cvss", + "key": "VA", + "version": "3.0.0", + "name": "Availability Impact to the Vulnerable System", + "definition": "This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no impact to availability within the Vulnerable System." + }, + { + "key": "L", + "name": "Low", + "definition": "There is reduced performance or interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System." + }, + { + "key": "H", + "name": "High", + "definition": "There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed)." + } + ] + }, + "cvss:EQ3:1.0.0": { + "namespace": "cvss", + "key": "EQ3", + "version": "1.0.0", + "name": "Equivalence Set 3", + "definition": "VC/VI/VA with 3 levels specified in Table 26", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (VC:H or VI:H or VA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: VC:H and VI:H" + } + ] + } + }, + "outcome": "cvss:EQ3:1.0.0", + "mapping": [ + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "L" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "N", + "cvss:EQ3:1.0.0": "H" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "N", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "N", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "L", + "cvss:EQ3:1.0.0": "H" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "L", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "L", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "M" + }, + { + "cvss:VC:3.0.0": "H", + "cvss:VI:3.0.0": "H", + "cvss:VA:3.0.0": "H", + "cvss:EQ3:1.0.0": "H" + } + ] + } + } + } + }, + "DT_CVSS4_EQ2": { + "key": "DT_CVSS4_EQ2", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "cvss", + "key": "DT_CVSS4_EQ2", + "version": "1.0.0", + "name": "CVSS v4 Equivalence Set 2", + "definition": "This decision table models equivalence set 2 from CVSS v4. Factors include Attack Complexity (AC) and Attack Requirements (AT).", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:AC:3.0.1": { + "namespace": "cvss", + "key": "AC", + "version": "3.0.1", + "name": "Attack Complexity", + "definition": "This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. ", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "H", + "name": "High", + "definition": "The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include: Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place." + }, + { + "key": "L", + "name": "Low", + "definition": "The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. " + } + ] + }, + "cvss:AT:1.0.0": { + "namespace": "cvss", + "key": "AT", + "version": "1.0.0", + "name": "Attack Requirements", + "definition": "This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Present", + "definition": "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." + }, + { + "key": "N", + "name": "None", + "definition": "The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability." + } + ] + }, + "cvss:EQ2:1.0.0": { + "namespace": "cvss", + "key": "EQ2", + "version": "1.0.0", + "name": "Equivalence Set 2", + "definition": "AC/AT with 2 levels specified in Table 25", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (AC:L and AT:N)" + }, + { + "key": "H", + "name": "High", + "definition": "0: AC:L and AT:N" + } + ] + } + }, + "outcome": "cvss:EQ2:1.0.0", + "mapping": [ + { + "cvss:AC:3.0.1": "H", + "cvss:AT:1.0.0": "P", + "cvss:EQ2:1.0.0": "L" + }, + { + "cvss:AC:3.0.1": "L", + "cvss:AT:1.0.0": "P", + "cvss:EQ2:1.0.0": "L" + }, + { + "cvss:AC:3.0.1": "H", + "cvss:AT:1.0.0": "N", + "cvss:EQ2:1.0.0": "L" + }, + { + "cvss:AC:3.0.1": "L", + "cvss:AT:1.0.0": "N", + "cvss:EQ2:1.0.0": "H" + } + ] + } + } + } + }, + "DT_CVSS_QSR": { + "key": "DT_CVSS_QSR", + "versions": { + "4.0.0": { + "version": "4.0.0", + "obj": { + "namespace": "cvss", + "key": "DT_CVSS_QSR", + "version": "4.0.0", + "name": "CVSS v4.0 Qualitative Severity Ratings", + "definition": "CVSS v4.0 using MacroVectors and Interpolation. See https://www.first.org/cvss/specification-document#New-Scoring-System-Development for details", + "schemaVersion": "2.0.0", + "decision_points": { + "cvss:EQ1:1.0.0": { + "namespace": "cvss", + "key": "EQ1", + "version": "1.0.0", + "name": "Equivalence Set 1", + "definition": "AV/PR/UI with 3 levels specified in Table 24", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: AV:P or not(AV:N or PR:N or UI:N)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: AV:N and PR:N and UI:N" + } + ] + }, + "cvss:EQ2:1.0.0": { + "namespace": "cvss", + "key": "EQ2", + "version": "1.0.0", + "name": "Equivalence Set 2", + "definition": "AC/AT with 2 levels specified in Table 25", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (AC:L and AT:N)" + }, + { + "key": "H", + "name": "High", + "definition": "0: AC:L and AT:N" + } + ] + }, + "cvss:EQ3:1.0.0": { + "namespace": "cvss", + "key": "EQ3", + "version": "1.0.0", + "name": "Equivalence Set 3", + "definition": "VC/VI/VA with 3 levels specified in Table 26", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (VC:H or VI:H or VA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: VC:H and VI:H" + } + ] + }, + "cvss:EQ4:1.0.0": { + "namespace": "cvss", + "key": "EQ4", + "version": "1.0.0", + "name": "Equivalence Set 4", + "definition": "SC/SI/SA with 3 levels specified in Table 27", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: MSI:S or MSA:S" + } + ] + }, + "cvss:EQ5:1.0.0": { + "namespace": "cvss", + "key": "EQ5", + "version": "1.0.0", + "name": "Equivalence Set 5", + "definition": "E with 3 levels specified in Table 28", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "2: E:U" + }, + { + "key": "M", + "name": "Medium", + "definition": "1: E:P" + }, + { + "key": "H", + "name": "High", + "definition": "0: E:A" + } + ] + }, + "cvss:EQ6:1.0.0": { + "namespace": "cvss", + "key": "EQ6", + "version": "1.0.0", + "name": "Equivalence Set 6", + "definition": "VC/VI/VA+CR/CI/CA with 2 levels specified in Table 29", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "1: not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)" + }, + { + "key": "H", + "name": "High", + "definition": "0: (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)" + } + ] + }, + "cvss:CVSS:1.0.0": { + "namespace": "cvss", + "key": "CVSS", + "version": "1.0.0", + "name": "CVSS Qualitative Severity Rating Scale", + "definition": "The CVSS Qualitative Severity Rating Scale group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "None (0.0)" + }, + { + "key": "L", + "name": "Low", + "definition": "Low (0.1-3.9)" + }, + { + "key": "M", + "name": "Medium", + "definition": "Medium (4.0-6.9)" + }, + { + "key": "H", + "name": "High", + "definition": "High (7.0-8.9)" + }, + { + "key": "C", + "name": "Critical", + "definition": "Critical (9.0-10.0)" + } + ] + } + }, + "outcome": "cvss:CVSS:1.0.0", + "mapping": [ + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "L" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "M" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "H" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "L", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "L", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "L", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "L", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "L", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "M", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "M", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "M", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "L", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "M", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + }, + { + "cvss:EQ1:1.0.0": "H", + "cvss:EQ2:1.0.0": "H", + "cvss:EQ3:1.0.0": "H", + "cvss:EQ4:1.0.0": "H", + "cvss:EQ5:1.0.0": "H", + "cvss:EQ6:1.0.0": "H", + "cvss:CVSS:1.0.0": "C" + } + ] + } + } + } + } + } + }, + "ssvc": { + "namespace": "ssvc", + "keys": { + "DT_DP": { + "key": "DT_DP", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "DT_DP", + "version": "1.0.0", + "name": "Deployer Patch Application Priority", + "definition": "Decision table for evaluating deployer's patch application priority in SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:E:1.1.0": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "ssvc:EXP:1.0.1": { + "namespace": "ssvc", + "key": "EXP", + "version": "1.0.1", + "name": "System Exposure", + "definition": "The Accessible Attack Surface of the Affected System or Service", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "S", + "name": "Small", + "definition": "Local service or program; highly controlled network" + }, + { + "key": "C", + "name": "Controlled", + "definition": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + { + "key": "O", + "name": "Open", + "definition": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + ] + }, + "ssvc:A:2.0.0": { + "namespace": "ssvc", + "key": "A", + "version": "2.0.0", + "name": "Automatable", + "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + ] + }, + "ssvc:HI:2.0.2": { + "namespace": "ssvc", + "key": "HI", + "version": "2.0.2", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] + }, + "ssvc:DSOI:1.0.0": { + "namespace": "ssvc", + "key": "DSOI", + "version": "1.0.0", + "name": "Defer, Scheduled, Out-of-Cycle, Immediate", + "definition": "The original SSVC outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Defer", + "definition": "Defer" + }, + { + "key": "S", + "name": "Scheduled", + "definition": "Scheduled" + }, + { + "key": "O", + "name": "Out-of-Cycle", + "definition": "Out-of-Cycle" + }, + { + "key": "I", + "name": "Immediate", + "definition": "Immediate" + } + ] + } + }, + "outcome": "ssvc:DSOI:1.0.0", + "mapping": [ + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "S", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "C", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "N", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "L", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "H", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:EXP:1.0.1": "O", + "ssvc:A:2.0.0": "Y", + "ssvc:HI:2.0.2": "VH", + "ssvc:DSOI:1.0.0": "I" + } + ] + } + } + } + }, + "DT_COORD_PUBLISH": { + "key": "DT_COORD_PUBLISH", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "DT_COORD_PUBLISH", + "version": "1.0.0", + "name": "Coordinator Publish Decision Table", + "definition": "This decision table is used to determine the priority of a coordinator publish.", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:SINV:1.0.0": { + "namespace": "ssvc", + "key": "SINV", + "version": "1.0.0", + "name": "Supplier Involvement", + "definition": "What is the state of the supplier’s work on addressing the vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "FR", + "name": "Fix Ready", + "definition": "The supplier has provided a patch or fix." + }, + { + "key": "C", + "name": "Cooperative", + "definition": "The supplier is actively generating a patch or fix; they may or may not have provided a mitigation or work-around in the mean time." + }, + { + "key": "UU", + "name": "Uncooperative/Unresponsive", + "definition": "The supplier has not responded, declined to generate a remediation, or no longer exists." + } + ] + }, + "ssvc:E:1.1.0": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "ssvc:PVA:1.0.0": { + "namespace": "ssvc", + "key": "PVA", + "version": "1.0.0", + "name": "Public Value Added", + "definition": "How much value would a publication from the coordinator benefit the broader community?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Limited", + "definition": "Minimal value added to the existing public information because existing information is already high quality and in multiple outlets." + }, + { + "key": "A", + "name": "Ampliative", + "definition": "Amplifies and/or augments the existing public information about the vulnerability, for example, adds additional detail, addresses or corrects errors in other public information, draws further attention to the vulnerability, etc." + }, + { + "key": "P", + "name": "Precedence", + "definition": "The publication would be the first publicly available, or be coincident with the first publicly available." + } + ] + }, + "ssvc:PUBLISH:1.0.0": { + "namespace": "ssvc", + "key": "PUBLISH", + "version": "1.0.0", + "name": "Publish, Do Not Publish", + "definition": "The publish outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Do Not Publish", + "definition": "Do Not Publish" + }, + { + "key": "P", + "name": "Publish", + "definition": "Publish" + } + ] + } + }, + "outcome": "ssvc:PUBLISH:1.0.0", + "mapping": [ + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "N" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "L", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "N", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "FR", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "A", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "P", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "C", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + }, + { + "ssvc:SINV:1.0.0": "UU", + "ssvc:E:1.1.0": "A", + "ssvc:PVA:1.0.0": "P", + "ssvc:PUBLISH:1.0.0": "P" + } + ] + } + } + } + }, + "DT_COORD_TRIAGE": { + "key": "DT_COORD_TRIAGE", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "DT_COORD_TRIAGE", + "version": "1.0.0", + "name": "Coordinator Triage", + "definition": "Decision table for coordinator triage", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:RP:1.0.0": { + "namespace": "ssvc", + "key": "RP", + "version": "1.0.0", + "name": "Report Public", + "definition": "Is a viable report of the details of the vulnerability already publicly available?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "Y", + "name": "Yes", + "definition": "A public report of the vulnerability exists." + }, + { + "key": "N", + "name": "No", + "definition": "No public report of the vulnerability exists." + } + ] + }, + "ssvc:SCON:1.0.0": { + "namespace": "ssvc", + "key": "SCON", + "version": "1.0.0", + "name": "Supplier Contacted", + "definition": "Has the reporter made a good-faith effort to contact the supplier of the vulnerable component using a quality contact method?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "The supplier has not been contacted." + }, + { + "key": "Y", + "name": "Yes", + "definition": "The supplier has been contacted." + } + ] + }, + "ssvc:RC:1.0.0": { + "namespace": "ssvc", + "key": "RC", + "version": "1.0.0", + "name": "Report Credibility", + "definition": "Is the report credible?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "NC", + "name": "Not Credible", + "definition": "The report is not credible." + }, + { + "key": "C", + "name": "Credible", + "definition": "The report is credible." + } + ] + }, + "ssvc:SC:1.0.0": { + "namespace": "ssvc", + "key": "SC", + "version": "1.0.0", + "name": "Supplier Cardinality", + "definition": "How many suppliers are responsible for the vulnerable component and its remediation or mitigation plan?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "O", + "name": "One", + "definition": "There is only one supplier of the vulnerable component." + }, + { + "key": "M", + "name": "Multiple", + "definition": "There are multiple suppliers of the vulnerable component." + } + ] + }, + "ssvc:SE:1.0.0": { + "namespace": "ssvc", + "key": "SE", + "version": "1.0.0", + "name": "Supplier Engagement", + "definition": "Is the supplier responding to the reporter’s contact effort and actively participating in the coordination effort?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "A", + "name": "Active", + "definition": "The supplier is responding to the reporter’s contact effort and actively participating in the coordination effort." + }, + { + "key": "U", + "name": "Unresponsive", + "definition": "The supplier is not responding to the reporter’s contact effort and not actively participating in the coordination effort." + } + ] + }, + "ssvc:U:1.0.1": { + "namespace": "ssvc", + "key": "U", + "version": "1.0.1", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + ] + }, + "ssvc:PSI:2.0.1": { + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.1", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:Negligible" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + } + ] + }, + "ssvc:COORDINATE:1.0.1": { + "namespace": "ssvc", + "key": "COORDINATE", + "version": "1.0.1", + "name": "Decline, Track, Coordinate", + "definition": "The coordinate outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Decline", + "definition": "Do not act on the report." + }, + { + "key": "T", + "name": "Track", + "definition": "Receive information about the vulnerability and monitor for status changes but do not take any overt actions." + }, + { + "key": "C", + "name": "Coordinate", + "definition": "Take action on the report." + } + ] + } + }, + "outcome": "ssvc:COORDINATE:1.0.1", + "mapping": [ + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "L", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "T" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "D" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "M", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "E", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "O", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "NC", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "N", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "Y", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + }, + { + "ssvc:RP:1.0.0": "N", + "ssvc:SCON:1.0.0": "Y", + "ssvc:RC:1.0.0": "C", + "ssvc:SC:1.0.0": "M", + "ssvc:SE:1.0.0": "U", + "ssvc:U:1.0.1": "S", + "ssvc:PSI:2.0.1": "S", + "ssvc:COORDINATE:1.0.1": "C" + } + ] + } + } + } + }, + "DT_HI": { + "key": "DT_HI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "DT_HI", + "version": "1.0.0", + "name": "Human Impact", + "definition": "Human Impact decision table for SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:SI:2.0.1": { + "namespace": "ssvc", + "key": "SI", + "version": "2.0.1", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability. (based on IEC 61508 with modifications)", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold. **Physical harm**: Minor injuries at worst (IEC 61508 Negligible). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. **System resiliency**: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. **Environment**: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses, which are not readily absorbable, to multiple persons. **Psychological**: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold. **Physical harm**: Major injuries to one or more persons (IEC 61508 Marginal). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. **System resiliency**: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. **Environment**: Major externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses that likely lead to bankruptcy of multiple persons. **Psychological**: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold. **Physical harm**: Loss of life (IEC 61508 Critical). **Operator resiliency**: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. **System resiliency**: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. **Environment**: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. **Financial**: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. **Psychological**: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. **Physical harm**: Multiple loss of life (IEC 61508 Catastrophic). **Operator resiliency**: Operator incapacitated (includes fatality or otherwise incapacitated). **System resiliency**: Total loss of whole cyber-physical system, of which the software is a part. **Environment**: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. **Financial**: Social systems (elections, financial grid, etc.) supported by the software collapse. **Psychological**: N/A." + } + ] + }, + "ssvc:MI:2.0.0": { + "namespace": "ssvc", + "key": "MI", + "version": "2.0.0", + "name": "Mission Impact", + "definition": "Impact on Mission Essential Functions of the Organization", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Degraded", + "definition": "Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions" + }, + { + "key": "MSC", + "name": "MEF Support Crippled", + "definition": "Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + { + "key": "MEF", + "name": "MEF Failure", + "definition": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + }, + { + "key": "MF", + "name": "Mission Failure", + "definition": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + } + ] + }, + "ssvc:HI:2.0.2": { + "namespace": "ssvc", + "key": "HI", + "version": "2.0.2", + "name": "Human Impact", + "definition": "Human Impact is a combination of Safety and Mission impacts.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Low", + "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)" + }, + { + "key": "M", + "name": "Medium", + "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))" + }, + { + "key": "H", + "name": "High", + "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)" + }, + { + "key": "VH", + "name": "Very High", + "definition": "Safety Impact:Catastrophic OR Mission Impact:Mission Failure" + } + ] + } + }, + "outcome": "ssvc:HI:2.0.2", + "mapping": [ + { + "ssvc:SI:2.0.1": "N", + "ssvc:MI:2.0.0": "D", + "ssvc:HI:2.0.2": "L" + }, + { + "ssvc:SI:2.0.1": "N", + "ssvc:MI:2.0.0": "MSC", + "ssvc:HI:2.0.2": "L" + }, + { + "ssvc:SI:2.0.1": "N", + "ssvc:MI:2.0.0": "MEF", + "ssvc:HI:2.0.2": "M" + }, + { + "ssvc:SI:2.0.1": "N", + "ssvc:MI:2.0.0": "MF", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:MI:2.0.0": "D", + "ssvc:HI:2.0.2": "L" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:MI:2.0.0": "MSC", + "ssvc:HI:2.0.2": "L" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:MI:2.0.0": "MEF", + "ssvc:HI:2.0.2": "M" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:MI:2.0.0": "MF", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:MI:2.0.0": "D", + "ssvc:HI:2.0.2": "M" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:MI:2.0.0": "MSC", + "ssvc:HI:2.0.2": "H" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:MI:2.0.0": "MEF", + "ssvc:HI:2.0.2": "H" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:MI:2.0.0": "MF", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:MI:2.0.0": "D", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:MI:2.0.0": "MSC", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:MI:2.0.0": "MEF", + "ssvc:HI:2.0.2": "VH" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:MI:2.0.0": "MF", + "ssvc:HI:2.0.2": "VH" + } + ] + } + } + } + }, + "DT_PSI": { + "key": "DT_PSI", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "DT_PSI", + "version": "1.0.0", + "name": "Public Safety Impact", + "definition": "Public Safety Impact Decision Table", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:SI:2.0.1": { + "namespace": "ssvc", + "key": "SI", + "version": "2.0.1", + "name": "Safety Impact", + "definition": "The safety impact of the vulnerability. (based on IEC 61508 with modifications)", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "Negligible", + "definition": "Any one or more of these conditions hold. **Physical harm**: Minor injuries at worst (IEC 61508 Negligible). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. **System resiliency**: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. **Environment**: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses, which are not readily absorbable, to multiple persons. **Psychological**: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons." + }, + { + "key": "M", + "name": "Marginal", + "definition": "Any one or more of these conditions hold. **Physical harm**: Major injuries to one or more persons (IEC 61508 Marginal). **Operator resiliency**: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. **System resiliency**: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. **Environment**: Major externalities (property damage, environmental damage, etc.) imposed on other parties. **Financial**: Financial losses that likely lead to bankruptcy of multiple persons. **Psychological**: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people." + }, + { + "key": "R", + "name": "Critical", + "definition": "Any one or more of these conditions hold. **Physical harm**: Loss of life (IEC 61508 Critical). **Operator resiliency**: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. **System resiliency**: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. **Environment**: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. **Financial**: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. **Psychological**: N/A." + }, + { + "key": "C", + "name": "Catastrophic", + "definition": "Any one or more of these conditions hold. **Physical harm**: Multiple loss of life (IEC 61508 Catastrophic). **Operator resiliency**: Operator incapacitated (includes fatality or otherwise incapacitated). **System resiliency**: Total loss of whole cyber-physical system, of which the software is a part. **Environment**: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. **Financial**: Social systems (elections, financial grid, etc.) supported by the software collapse. **Psychological**: N/A." + } + ] + }, + "ssvc:PSI:2.0.1": { + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.1", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:Negligible" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + } + ] + } + }, + "outcome": "ssvc:PSI:2.0.1", + "mapping": [ + { + "ssvc:SI:2.0.1": "N", + "ssvc:PSI:2.0.1": "M" + }, + { + "ssvc:SI:2.0.1": "M", + "ssvc:PSI:2.0.1": "S" + }, + { + "ssvc:SI:2.0.1": "R", + "ssvc:PSI:2.0.1": "S" + }, + { + "ssvc:SI:2.0.1": "C", + "ssvc:PSI:2.0.1": "S" + } + ] + } + } + } + }, + "DT_SP": { + "key": "DT_SP", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "DT_SP", + "version": "1.0.0", + "name": "Supplier Patch Development Priority", + "definition": "Decision table for evaluating supplier patch development priority in SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:E:1.1.0": { + "namespace": "ssvc", + "key": "E", + "version": "1.1.0", + "name": "Exploitation", + "definition": "The present state of exploitation of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "None", + "definition": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "key": "P", + "name": "Public PoC", + "definition": "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation." + }, + { + "key": "A", + "name": "Active", + "definition": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + "ssvc:U:1.0.1": { + "namespace": "ssvc", + "key": "U", + "version": "1.0.1", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + ] + }, + "ssvc:TI:1.0.0": { + "namespace": "ssvc", + "key": "TI", + "version": "1.0.0", + "name": "Technical Impact", + "definition": "The technical impact of the vulnerability.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "P", + "name": "Partial", + "definition": "The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control." + }, + { + "key": "T", + "name": "Total", + "definition": "The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability." + } + ] + }, + "ssvc:PSI:2.0.1": { + "namespace": "ssvc", + "key": "PSI", + "version": "2.0.1", + "name": "Public Safety Impact", + "definition": "A coarse-grained representation of impact to public safety.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "M", + "name": "Minimal", + "definition": "Safety Impact:Negligible" + }, + { + "key": "S", + "name": "Significant", + "definition": "Safety Impact:(Marginal OR Critical OR Catastrophic)" + } + ] + }, + "ssvc:DSOI:1.0.0": { + "namespace": "ssvc", + "key": "DSOI", + "version": "1.0.0", + "name": "Defer, Scheduled, Out-of-Cycle, Immediate", + "definition": "The original SSVC outcome group.", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Defer", + "definition": "Defer" + }, + { + "key": "S", + "name": "Scheduled", + "definition": "Scheduled" + }, + { + "key": "O", + "name": "Out-of-Cycle", + "definition": "Out-of-Cycle" + }, + { + "key": "I", + "name": "Immediate", + "definition": "Immediate" + } + ] + } + }, + "outcome": "ssvc:DSOI:1.0.0", + "mapping": [ + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "D" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "N", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "S" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "P", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "L", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "O" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "E", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "P", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "M", + "ssvc:DSOI:1.0.0": "I" + }, + { + "ssvc:E:1.1.0": "A", + "ssvc:U:1.0.1": "S", + "ssvc:TI:1.0.0": "T", + "ssvc:PSI:2.0.1": "S", + "ssvc:DSOI:1.0.0": "I" + } + ] + } + } + } + }, + "DT_U": { + "key": "DT_U", + "versions": { + "1.0.0": { + "version": "1.0.0", + "obj": { + "namespace": "ssvc", + "key": "DT_U", + "version": "1.0.0", + "name": "Utility", + "definition": "Utility decision table for SSVC", + "schemaVersion": "2.0.0", + "decision_points": { + "ssvc:A:2.0.0": { + "namespace": "ssvc", + "key": "A", + "version": "2.0.0", + "name": "Automatable", + "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "N", + "name": "No", + "definition": "Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation." + }, + { + "key": "Y", + "name": "Yes", + "definition": "Attackers can reliably automate steps 1-4 of the kill chain." + } + ] + }, + "ssvc:VD:1.0.0": { + "namespace": "ssvc", + "key": "VD", + "version": "1.0.0", + "name": "Value Density", + "definition": "The concentration of value in the target", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "D", + "name": "Diffuse", + "definition": "The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small." + }, + { + "key": "C", + "name": "Concentrated", + "definition": "The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users." + } + ] + }, + "ssvc:U:1.0.1": { + "namespace": "ssvc", + "key": "U", + "version": "1.0.1", + "name": "Utility", + "definition": "The Usefulness of the Exploit to the Adversary", + "schemaVersion": "2.0.0", + "values": [ + { + "key": "L", + "name": "Laborious", + "definition": "Automatable:No AND Value Density:Diffuse" + }, + { + "key": "E", + "name": "Efficient", + "definition": "(Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated)" + }, + { + "key": "S", + "name": "Super Effective", + "definition": "Automatable:Yes AND Value Density:Concentrated" + } + ] + } + }, + "outcome": "ssvc:U:1.0.1", + "mapping": [ + { + "ssvc:A:2.0.0": "N", + "ssvc:VD:1.0.0": "D", + "ssvc:U:1.0.1": "L" + }, + { + "ssvc:A:2.0.0": "N", + "ssvc:VD:1.0.0": "C", + "ssvc:U:1.0.1": "E" + }, + { + "ssvc:A:2.0.0": "Y", + "ssvc:VD:1.0.0": "D", + "ssvc:U:1.0.1": "E" + }, + { + "ssvc:A:2.0.0": "Y", + "ssvc:VD:1.0.0": "C", + "ssvc:U:1.0.1": "S" + } + ] + } + } + } + } + } + } + } + } + } +} diff --git a/data/schema/current/Decision_Point.schema.json b/data/schema/current/Decision_Point.schema.json index b1e5866a..7c5009fd 120000 --- a/data/schema/current/Decision_Point.schema.json +++ b/data/schema/current/Decision_Point.schema.json @@ -1 +1 @@ -../v1/Decision_Point-1-0-1.schema.json \ No newline at end of file +../v2/DecisionPoint_2_0_0.schema.json \ No newline at end of file diff --git a/data/schema/current/Decision_Point_Group.schema.json b/data/schema/current/Decision_Point_Group.schema.json index 22a4f53a..1507d00b 120000 --- a/data/schema/current/Decision_Point_Group.schema.json +++ b/data/schema/current/Decision_Point_Group.schema.json @@ -1 +1 @@ -../v1/Decision_Point_Group-1-0-1.schema.json \ No newline at end of file +../v1/Decision_Point_Group-1-1-0.schema.json \ No newline at end of file diff --git a/data/schema/current/Decision_Point_Value_Selection.schema.json b/data/schema/current/Decision_Point_Value_Selection.schema.json index b708b5d7..621d962d 120000 --- a/data/schema/current/Decision_Point_Value_Selection.schema.json +++ b/data/schema/current/Decision_Point_Value_Selection.schema.json @@ -1 +1 @@ -../v1/Decision_Point_Value_Selection-1-0-1.schema.json \ No newline at end of file +../v2/SelectionList_2_0_0.schema.json \ No newline at end of file diff --git a/data/schema/current/Decision_Table.schema.json b/data/schema/current/Decision_Table.schema.json new file mode 120000 index 00000000..8c32fc6d --- /dev/null +++ b/data/schema/current/Decision_Table.schema.json @@ -0,0 +1 @@ +../v2/DecisionTable_2_0_0.schema.json \ No newline at end of file diff --git a/data/schema/v1/Decision_Point_Group-1-1-0.schema.json b/data/schema/v1/Decision_Point_Group-1-1-0.schema.json new file mode 100644 index 00000000..a30d2ad2 --- /dev/null +++ b/data/schema/v1/Decision_Point_Group-1-1-0.schema.json @@ -0,0 +1,60 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "title": "Decision Points Group schema definition.", + "$id": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point_Group-1-1-0.schema.json", + "description": "Decision Point Groups are sets of decision points pinned to specific versions of those decision points. These groups may change over time.", + "$defs": { + "schemaVersion": { + "description": "Schema version used to represent Decision Point Group.", + "type": "string", + "enum": [ + "1-0-1" + ] + }, + "decision_point_group": { + "type": "object", + "additionalProperties": false, + "properties": { + "schemaVersion": { + "$ref": "#/$defs/schemaVersion" + }, + "version": { + "$ref": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json#/$defs/decision_point/properties/version" + }, + "name": { + "type": "string", + "description": "A short label that captures the description of the Decision Point Group.", + "minLength": 1, + "examples": [ + "SSVC Supplier", + "Coordinator Triage", + "SSVC Deployer" + ] + }, + "description": { + "type": "string", + "description": "A full description of the Decision Point Group.", + "minLength": 1, + "examples": [ + "These decision points used by the Coordinator during publication." + ] + }, + "decision_points": { + "type": "object", + "additionalProperties": { + "$ref": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json" + }, + "description": "A set of decision points that are part of this Decision Point Group." + } + }, + "required": [ + "version", + "name", + "description", + "decision_points", + "schemaVersion" + ] + } + }, + "$ref": "#/$defs/decision_point_group" +} \ No newline at end of file diff --git a/data/schema/v2/DecisionPointGroup_2_0_0.schema.json b/data/schema/v2/DecisionPointGroup_2_0_0.schema.json new file mode 100644 index 00000000..8c88f921 --- /dev/null +++ b/data/schema/v2/DecisionPointGroup_2_0_0.schema.json @@ -0,0 +1,170 @@ +{ + "title": "DecisionPointGroup", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://certcc.github.io/SSVC/data/schema/v2/DecisionPointGroup_2_0_0.schema.json", + "description": "**DEPRECATED:** `DecisionPointGroup` has been superseded by `DecisionTable`.\nNew development should use `DecisionTable` instead.\nWe are keeping this class around for backward compatibility, but it may be removed in future releases.\n\nThis schema defines the structure to represent an SSVC DecisionPointGroup object.", + "type": "object", + "$defs": { + "DecisionPoint": { + "title": "DecisionPoint", + "description": "Models a single decision point as a list of values.\n\nDecision points should have the following attributes:\n\n- name (str): The name of the decision point\n- description (str): A description of the decision point\n- version (str): A semantic version string for the decision point\n- namespace (str): The namespace (a short, unique string): For example, \"ssvc\" or \"cvss\" to indicate the source of the decision point\n- key (str): A key (a short, unique string within the namespace) that can be used to identify the decision point in a shorthand way\n- values (tuple): A tuple of DecisionPointValue objects", + "properties": { + "namespace": { + "title": "Namespace", + "description": "The namespace of the SSVC object.", + "examples": [ + "ssvc", + "cisa", + "x_example.test#test//.example.test#private-extension", + "ssvc/de-DE/.example.organization#reference-arch-1" + ], + "maxLength": 1000, + "minLength": 3, + "pattern": "^(x_([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|[a-z]([a-z]|[0-9])(((\\.|-))?(([a-z]|[0-9]))+)+(\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)?)((/|/(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo))((/((([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)|\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|\\.(([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+|([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)\\$(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)))+)?)?$", + "type": "string" + }, + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "version": { + "title": "Version", + "default": "0.0.1", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "type": "string" + }, + "values": { + "title": "Values", + "items": { + "$ref": "#/$defs/DecisionPointValue" + }, + "type": "array" + } + }, + "required": [ + "namespace", + "key", + "name", + "definition", + "schemaVersion", + "values" + ], + "type": "object" + }, + "DecisionPointValue": { + "title": "DecisionPointValue", + "description": "Models a single value option for a decision point.\n\nEach value should have the following attributes:\n\n- name (str): A name\n- description (str): A description\n- key (str): A key (a short, unique string) that can be used to identify the value in a shorthand way\n- _comment (str): An optional comment that will be included in the object.", + "properties": { + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "key", + "name", + "definition" + ], + "type": "object" + } + }, + "properties": { + "version": { + "title": "Version", + "default": "0.0.1", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "decision_points": { + "title": "Decision Points", + "additionalProperties": { + "$ref": "#/$defs/DecisionPoint" + }, + "type": "object" + } + }, + "required": [ + "schemaVersion", + "name", + "definition", + "decision_points" + ] +} diff --git a/data/schema/v2/DecisionPoint_2_0_0.schema.json b/data/schema/v2/DecisionPoint_2_0_0.schema.json new file mode 100644 index 00000000..0fe6e2f7 --- /dev/null +++ b/data/schema/v2/DecisionPoint_2_0_0.schema.json @@ -0,0 +1,123 @@ +{ + "title": "DecisionPoint", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://certcc.github.io/SSVC/data/schema/v2/DecisionPoint_2_0_0.schema.json", + "description": "This schema defines the structure to represent an SSVC DecisionPoint object.", + "type": "object", + "$defs": { + "DecisionPointValue": { + "title": "DecisionPointValue", + "description": "Models a single value option for a decision point.\n\nEach value should have the following attributes:\n\n- name (str): A name\n- description (str): A description\n- key (str): A key (a short, unique string) that can be used to identify the value in a shorthand way\n- _comment (str): An optional comment that will be included in the object.", + "properties": { + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "key", + "name", + "definition" + ], + "type": "object" + } + }, + "properties": { + "namespace": { + "title": "Namespace", + "description": "The namespace of the SSVC object.", + "examples": [ + "ssvc", + "cisa", + "x_example.test#test//.example.test#private-extension", + "ssvc/de-DE/.example.organization#reference-arch-1" + ], + "maxLength": 1000, + "minLength": 3, + "pattern": "^(x_([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|[a-z]([a-z]|[0-9])(((\\.|-))?(([a-z]|[0-9]))+)+(\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)?)((/|/(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo))((/((([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)|\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|\\.(([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+|([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)\\$(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)))+)?)?$", + "type": "string" + }, + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "version": { + "title": "Version", + "default": "0.0.1", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "type": "string" + }, + "values": { + "title": "Values", + "items": { + "$ref": "#/$defs/DecisionPointValue" + }, + "type": "array" + } + }, + "required": [ + "namespace", + "key", + "name", + "definition", + "schemaVersion", + "values" + ] +} diff --git a/data/schema/v2/DecisionTable_2_0_0.schema.json b/data/schema/v2/DecisionTable_2_0_0.schema.json new file mode 100644 index 00000000..3e861073 --- /dev/null +++ b/data/schema/v2/DecisionTable_2_0_0.schema.json @@ -0,0 +1,223 @@ +{ + "title": "DecisionTable", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://certcc.github.io/SSVC/data/schema/v2/DecisionTable_2_0_0.schema.json", + "description": "This schema defines the structure to represent an SSVC DecisionTable object.", + "type": "object", + "$defs": { + "DecisionPoint": { + "title": "DecisionPoint", + "description": "Models a single decision point as a list of values.\n\nDecision points should have the following attributes:\n\n- name (str): The name of the decision point\n- description (str): A description of the decision point\n- version (str): A semantic version string for the decision point\n- namespace (str): The namespace (a short, unique string): For example, \"ssvc\" or \"cvss\" to indicate the source of the decision point\n- key (str): A key (a short, unique string within the namespace) that can be used to identify the decision point in a shorthand way\n- values (tuple): A tuple of DecisionPointValue objects", + "properties": { + "namespace": { + "title": "Namespace", + "description": "The namespace of the SSVC object.", + "examples": [ + "ssvc", + "cisa", + "x_example.test#test//.example.test#private-extension", + "ssvc/de-DE/.example.organization#reference-arch-1" + ], + "maxLength": 1000, + "minLength": 3, + "pattern": "^(x_([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|[a-z]([a-z]|[0-9])(((\\.|-))?(([a-z]|[0-9]))+)+(\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)?)((/|/(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo))((/((([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)|\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|\\.(([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+|([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)\\$(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)))+)?)?$", + "type": "string" + }, + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "version": { + "title": "Version", + "default": "0.0.1", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "type": "string" + }, + "values": { + "title": "Values", + "items": { + "$ref": "#/$defs/DecisionPointValue" + }, + "type": "array" + } + }, + "required": [ + "namespace", + "key", + "name", + "definition", + "schemaVersion", + "values" + ], + "type": "object" + }, + "DecisionPointValue": { + "title": "DecisionPointValue", + "description": "Models a single value option for a decision point.\n\nEach value should have the following attributes:\n\n- name (str): A name\n- description (str): A description\n- key (str): A key (a short, unique string) that can be used to identify the value in a shorthand way\n- _comment (str): An optional comment that will be included in the object.", + "properties": { + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "key", + "name", + "definition" + ], + "type": "object" + } + }, + "properties": { + "namespace": { + "title": "Namespace", + "description": "The namespace of the SSVC object.", + "examples": [ + "ssvc", + "cisa", + "x_example.test#test//.example.test#private-extension", + "ssvc/de-DE/.example.organization#reference-arch-1" + ], + "maxLength": 1000, + "minLength": 3, + "pattern": "^(x_([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|[a-z]([a-z]|[0-9])(((\\.|-))?(([a-z]|[0-9]))+)+(\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)?)((/|/(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo))((/((([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)|\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|\\.(([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+|([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)\\$(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)))+)?)?$", + "type": "string" + }, + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "version": { + "title": "Version", + "default": "0.0.1", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "type": "string" + }, + "decision_points": { + "title": "Decision Points", + "additionalProperties": { + "$ref": "#/$defs/DecisionPoint" + }, + "description": "A non-empty dictionary of decision points Decision point IDs are recommended as keys.", + "minProperties": 1, + "type": "object" + }, + "outcome": { + "title": "Outcome", + "description": "The key of the decision point in `self.decision_points` that represents the outcome of the decision table.", + "minLength": 1, + "type": "string" + }, + "mapping": { + "title": "Mapping", + "description": "Mapping of decision point values to outcomes.", + "items": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "namespace", + "key", + "name", + "definition", + "schemaVersion", + "decision_points", + "outcome" + ] +} diff --git a/data/schema/v2/Decision_Point-2-0-0.schema.json b/data/schema/v2/Decision_Point-2-0-0.schema.json new file mode 120000 index 00000000..338da14d --- /dev/null +++ b/data/schema/v2/Decision_Point-2-0-0.schema.json @@ -0,0 +1 @@ +DecisionPoint_2_0_0.schema.json \ No newline at end of file diff --git a/data/schema/v2/Decision_Point_Group-2-0-0.schema.json b/data/schema/v2/Decision_Point_Group-2-0-0.schema.json new file mode 120000 index 00000000..1d739f41 --- /dev/null +++ b/data/schema/v2/Decision_Point_Group-2-0-0.schema.json @@ -0,0 +1 @@ +DecisionPointGroup_2_0_0.schema.json \ No newline at end of file diff --git a/data/schema/v2/Decision_Point_Value_Selection-2-0-0.schema.json b/data/schema/v2/Decision_Point_Value_Selection-2-0-0.schema.json new file mode 120000 index 00000000..c3a73af7 --- /dev/null +++ b/data/schema/v2/Decision_Point_Value_Selection-2-0-0.schema.json @@ -0,0 +1 @@ +SelectionList_2_0_0.schema.json \ No newline at end of file diff --git a/data/schema/v2/Decision_Table-2-0-0.schema.json b/data/schema/v2/Decision_Table-2-0-0.schema.json new file mode 120000 index 00000000..0769660f --- /dev/null +++ b/data/schema/v2/Decision_Table-2-0-0.schema.json @@ -0,0 +1 @@ +DecisionTable_2_0_0.schema.json \ No newline at end of file diff --git a/data/schema/v2/README.md b/data/schema/v2/README.md new file mode 100644 index 00000000..bdb73b27 --- /dev/null +++ b/data/schema/v2/README.md @@ -0,0 +1,9 @@ +# SSVC JSON Schemas v2 Readme + +## Why are there soft links here? + +We are now automatically generating the schema files for SSVC based on their +corresponding Pydantic models. This allows us to keep the schema files in sync +with the code more easily. However, it required us to make some changes to the +file names. So we've left behind some soft links from the original file names +to help ease the transition. diff --git a/data/schema/v2/SelectionList_2_0_0.schema.json b/data/schema/v2/SelectionList_2_0_0.schema.json new file mode 100644 index 00000000..8517ccbc --- /dev/null +++ b/data/schema/v2/SelectionList_2_0_0.schema.json @@ -0,0 +1,259 @@ +{ + "title": "SelectionList", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://certcc.github.io/SSVC/data/schema/v2/SelectionList_2_0_0.schema.json", + "description": "This schema defines the structure to represent an SSVC SelectionList object.", + "type": "object", + "$defs": { + "MinimalDecisionPointValue": { + "title": "MinimalDecisionPointValue", + "additionalProperties": false, + "description": "A minimal representation of a decision point value.\nIntended to parallel the DecisionPointValue object, but with fewer required fields.\nA decision point value is uniquely identified within a decision point by its key.\nGlobally, the combination of Decision Point namespace, key, and version coupled with the value key\nuniquely identifies a value across all decision points and values.\nOther required fields in the DecisionPointValue object, such as name and description, are optional here.", + "properties": { + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + } + }, + "required": [ + "key" + ], + "type": "object" + }, + "Reference": { + "title": "Reference", + "additionalProperties": false, + "description": "A reference to a resource that provides additional context about the decision points or selections.\nThis object is intentionally minimal and contains only the URL and an optional description.", + "properties": { + "uri": { + "title": "Uri", + "format": "uri", + "minLength": 1, + "type": "string" + }, + "summary": { + "title": "Summary", + "type": "string" + } + }, + "required": [ + "uri", + "summary" + ], + "type": "object" + }, + "Selection": { + "title": "Selection", + "additionalProperties": false, + "description": "A minimal selection object that contains the decision point ID and the selected values.\nWhile the Selection object parallels the DecisionPoint object, it is intentionally minimal, with\nfewer required fields and no additional metadata, as it is meant to represent a selection made from a\npreviously defined decision point. The expectation is that a Selection object will usually have\nfewer values than the original decision point, as it represents a specific evaluation\nat a specific time and may therefore rule out some values that were previously considered.\nOther fields like name and description may be copied from the decision point, but are not required.", + "properties": { + "namespace": { + "title": "Namespace", + "description": "The namespace of the SSVC object.", + "examples": [ + "ssvc", + "cisa", + "x_example.test#test//.example.test#private-extension", + "ssvc/de-DE/.example.organization#reference-arch-1" + ], + "maxLength": 1000, + "minLength": 3, + "pattern": "^(x_([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|[a-z]([a-z]|[0-9])(((\\.|-))?(([a-z]|[0-9]))+)+(\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)?)((/|/(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo))((/((([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)|\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|\\.(([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+|([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)\\$(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)))+)?)?$", + "type": "string" + }, + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "version": { + "title": "Version", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "values": { + "title": "Values", + "description": "A list of selected value keys from the decision point values.", + "examples": [ + [ + { + "key": "N" + }, + { + "key": "Y" + } + ], + [ + { + "key": "A" + }, + { + "key": "B" + }, + { + "key": "C" + } + ] + ], + "items": { + "$ref": "#/$defs/MinimalDecisionPointValue" + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "namespace", + "key", + "version", + "values" + ], + "type": "object" + } + }, + "properties": { + "timestamp": { + "title": "Timestamp", + "description": "Timestamp of the selections, in RFC 3339 format.", + "examples": [ + "2025-01-01T12:00:00Z", + "2025-01-02T15:30:45-04:00" + ], + "format": "date-time", + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "description": "The schema version of this selection list.", + "type": "string" + }, + "target_ids": { + "title": "Target Ids", + "description": "Optional list of identifiers for the item or items (vulnerabilities, reports, advisories, systems, assets, etc.) being evaluated by these selections.", + "examples": [ + [ + "CVE-1900-0000" + ], + [ + "VU#999999", + "GHSA-0123-4567-89ab" + ] + ], + "items": { + "type": "string" + }, + "minItems": 1, + "type": "array", + "uniqueItems": true + }, + "selections": { + "title": "Selections", + "description": "List of selections made from decision points. Each selection item corresponds to value keys contained in a specific decision point identified by its namespace, key, and version. Note that selection objects are deliberately minimal objects and do not contain the full decision point details.", + "items": { + "$ref": "#/$defs/Selection" + }, + "minItems": 1, + "type": "array" + }, + "decision_point_resources": { + "title": "Decision Point Resources", + "description": "A list of resources that provide additional context about the decision points found in this selection.", + "examples": [ + [ + { + "summary": "Documentation for a set of decision points", + "uri": "https://example.com/decision_points" + }, + { + "summary": "JSON representation of decision point 2", + "uri": "https://example.org/definitions/dp2.json" + }, + { + "summary": "A JSON file containing extension decision points in the x_com.example namespace", + "uri": "https://example.com/ssvc/x_com.example/decision_points.json" + } + ] + ], + "items": { + "$ref": "#/$defs/Reference" + }, + "minItems": 1, + "type": "array" + }, + "references": { + "title": "References", + "description": "A list of references that provide additional context about the specific values selected.", + "examples": [ + [ + { + "summary": "A report on which the selections were based", + "uri": "https://example.com/report" + } + ] + ], + "items": { + "$ref": "#/$defs/Reference" + }, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "timestamp", + "schemaVersion", + "selections" + ], + "additionalProperties": false +} diff --git a/data/schema/v2/SsvcObjectRegistry_2_0_0.schema.json b/data/schema/v2/SsvcObjectRegistry_2_0_0.schema.json new file mode 100644 index 00000000..4a59209e --- /dev/null +++ b/data/schema/v2/SsvcObjectRegistry_2_0_0.schema.json @@ -0,0 +1,385 @@ +{ + "title": "SsvcObjectRegistry", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://certcc.github.io/SSVC/data/schema/v2/SsvcObjectRegistry_2_0_0.schema.json", + "description": "This schema defines the structure to represent an SSVC SsvcObjectRegistry object.", + "type": "object", + "$defs": { + "DecisionPoint": { + "title": "DecisionPoint", + "description": "Models a single decision point as a list of values.\n\nDecision points should have the following attributes:\n\n- name (str): The name of the decision point\n- description (str): A description of the decision point\n- version (str): A semantic version string for the decision point\n- namespace (str): The namespace (a short, unique string): For example, \"ssvc\" or \"cvss\" to indicate the source of the decision point\n- key (str): A key (a short, unique string within the namespace) that can be used to identify the decision point in a shorthand way\n- values (tuple): A tuple of DecisionPointValue objects", + "properties": { + "namespace": { + "title": "Namespace", + "description": "The namespace of the SSVC object.", + "examples": [ + "ssvc", + "cisa", + "x_example.test#test//.example.test#private-extension", + "ssvc/de-DE/.example.organization#reference-arch-1" + ], + "maxLength": 1000, + "minLength": 3, + "pattern": "^(x_([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|[a-z]([a-z]|[0-9])(((\\.|-))?(([a-z]|[0-9]))+)+(\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)?)((/|/(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo))((/((([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)|\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|\\.(([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+|([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)\\$(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)))+)?)?$", + "type": "string" + }, + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "version": { + "title": "Version", + "default": "0.0.1", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "type": "string" + }, + "values": { + "title": "Values", + "items": { + "$ref": "#/$defs/DecisionPointValue" + }, + "type": "array" + } + }, + "required": [ + "namespace", + "key", + "name", + "definition", + "schemaVersion", + "values" + ], + "type": "object" + }, + "DecisionPointValue": { + "title": "DecisionPointValue", + "description": "Models a single value option for a decision point.\n\nEach value should have the following attributes:\n\n- name (str): A name\n- description (str): A description\n- key (str): A key (a short, unique string) that can be used to identify the value in a shorthand way\n- _comment (str): An optional comment that will be included in the object.", + "properties": { + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "key", + "name", + "definition" + ], + "type": "object" + }, + "DecisionTable": { + "title": "DecisionTable", + "description": "DecisionTable: A flexible, serializable SSVC decision table model.\n\nThis model represents a decision table that can be used to map combinations of decision point values\nto outcomes. It allows for flexible mapping and can be used with helper methods to generate DataFrame and CSV representations\nof the decision table.\n\nAttributes:", + "properties": { + "namespace": { + "title": "Namespace", + "description": "The namespace of the SSVC object.", + "examples": [ + "ssvc", + "cisa", + "x_example.test#test//.example.test#private-extension", + "ssvc/de-DE/.example.organization#reference-arch-1" + ], + "maxLength": 1000, + "minLength": 3, + "pattern": "^(x_([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|[a-z]([a-z]|[0-9])(((\\.|-))?(([a-z]|[0-9]))+)+(\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)?)((/|/(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo))((/((([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)|\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*|\\.(([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+|([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?(\\.([a-z]|[0-9])(((([a-z]|[0-9])|-)){0,61}([a-z]|[0-9]))?)+\\#(([a-z]|[0-9]))+((\\.|-)(([a-z]|[0-9]))+)*)\\$(([a-zA-Z]{2,3}(-[a-zA-Z]{3}(-[a-zA-Z]{3}){0,2})?|[a-zA-Z]{4,8})(-[a-zA-Z]{4})?(-([a-zA-Z]{2}|[0-9]{3}))?(-(([a-zA-Z0-9]){5,8}|[0-9]([a-zA-Z0-9]){3}))*(-[0-9A-WY-Za-wy-z](-([a-zA-Z0-9]){2,8})+)*(-[xX](-([a-zA-Z0-9]){2,8})+)?|[xX](-([a-zA-Z0-9]){2,8})+|i-default|i-mingo)))+)?)?$", + "type": "string" + }, + "key": { + "title": "Key", + "description": "A short, non-empty string identifier for the object. Keys must start with an alphanumeric, contain only alphanumerics and `_`, and end with an alphanumeric.(`T*` is explicitly grandfathered in as a valid key, but should not be used for new objects.)", + "examples": [ + "E", + "A", + "SI", + "L", + "M", + "H", + "Mixed_case_OK", + "alph4num3ric" + ], + "minLength": 1, + "pattern": "^(([a-zA-Z0-9])|([a-zA-Z0-9][a-zA-Z0-9_]*[a-zA-Z0-9])|(T\\*))$", + "type": "string" + }, + "version": { + "title": "Version", + "default": "0.0.1", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "type": "string" + }, + "decision_points": { + "title": "Decision Points", + "additionalProperties": { + "$ref": "#/$defs/DecisionPoint" + }, + "description": "A non-empty dictionary of decision points Decision point IDs are recommended as keys.", + "minProperties": 1, + "type": "object" + }, + "outcome": { + "title": "Outcome", + "description": "The key of the decision point in `self.decision_points` that represents the outcome of the decision table.", + "minLength": 1, + "type": "string" + }, + "mapping": { + "title": "Mapping", + "description": "Mapping of decision point values to outcomes.", + "items": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "namespace", + "key", + "name", + "definition", + "schemaVersion", + "decision_points", + "outcome" + ], + "type": "object" + }, + "_Key": { + "title": "_Key", + "properties": { + "key": { + "title": "Key", + "type": "string" + }, + "versions": { + "title": "Versions", + "additionalProperties": { + "anyOf": [ + { + "$ref": "#/$defs/_ValuedVersion" + }, + { + "$ref": "#/$defs/_NonValuedVersion" + } + ] + }, + "description": "A dictionary mapping version strings to versioned objects.", + "type": "object" + } + }, + "required": [ + "key" + ], + "type": "object" + }, + "_Namespace": { + "title": "_Namespace", + "properties": { + "namespace": { + "title": "Namespace", + "type": "string" + }, + "keys": { + "title": "Keys", + "additionalProperties": { + "$ref": "#/$defs/_Key" + }, + "description": "A dictionary mapping keys to Key objects within this namespace.", + "type": "object" + } + }, + "required": [ + "namespace" + ], + "type": "object" + }, + "_NonValuedVersion": { + "title": "_NonValuedVersion", + "properties": { + "version": { + "title": "Version", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "obj": { + "$ref": "#/$defs/DecisionTable" + } + }, + "required": [ + "version", + "obj" + ], + "type": "object" + }, + "_NsType": { + "title": "_NsType", + "properties": { + "type": { + "title": "Type", + "type": "string" + }, + "namespaces": { + "title": "Namespaces", + "additionalProperties": { + "$ref": "#/$defs/_Namespace" + }, + "description": "A dictionary mapping obj types to Namespace objects.", + "type": "object" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "_ValuedVersion": { + "title": "_ValuedVersion", + "properties": { + "version": { + "title": "Version", + "description": "The version of the SSVC object. This must be a valid semantic version string.", + "examples": [ + "1.0.0", + "2.1.3" + ], + "minLength": 5, + "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", + "type": "string" + }, + "obj": { + "$ref": "#/$defs/DecisionPoint" + }, + "values": { + "title": "Values", + "additionalProperties": { + "$ref": "#/$defs/DecisionPointValue" + }, + "description": "A dictionary mapping value keys to DecisionPointValue objects.", + "type": "object" + } + }, + "required": [ + "version", + "obj" + ], + "type": "object" + } + }, + "properties": { + "name": { + "title": "Name", + "minLength": 1, + "type": "string" + }, + "definition": { + "title": "Definition", + "minLength": 1, + "type": "string" + }, + "schemaVersion": { + "title": "Schemaversion", + "const": "2.0.0", + "description": "The schema version of this selection list.", + "type": "string" + }, + "types": { + "title": "Types", + "additionalProperties": { + "$ref": "#/$defs/_NsType" + }, + "description": "A dictionary mapping type names to NsType objects.", + "type": "object" + } + }, + "required": [ + "name", + "definition", + "schemaVersion" + ] +} diff --git a/data/schema/v2/Ssvc_Object_Registry-2-0-0.schema.json b/data/schema/v2/Ssvc_Object_Registry-2-0-0.schema.json new file mode 120000 index 00000000..5a33efc3 --- /dev/null +++ b/data/schema/v2/Ssvc_Object_Registry-2-0-0.schema.json @@ -0,0 +1 @@ +SsvcObjectRegistry_2_0_0.schema.json \ No newline at end of file diff --git a/data/schema_examples/CVE-1900-1234-Decision_Point_Value_Selection-2-0-0.json b/data/schema_examples/CVE-1900-1234-Decision_Point_Value_Selection-2-0-0.json new file mode 100644 index 00000000..1474b52b --- /dev/null +++ b/data/schema_examples/CVE-1900-1234-Decision_Point_Value_Selection-2-0-0.json @@ -0,0 +1,34 @@ +{ + "target_ids": ["CVE-1900-1234"], + "timestamp": "2021-09-29T15:29:44Z", + "schemaVersion": "2.0.0", + "selections": [ + { + "namespace": "ssvc", + "name": "Exploitation", + "key": "E", + "version": "1.1.0", + "values": [ + {"name":"Active", "key": "A"} + ] + }, + { + "namespace": "ssvc", + "name": "Automatable", + "key": "A", + "version": "2.0.0", + "values": [ + {"name": "Yes", "key": "Y"} + ] + }, + { + "namespace": "ssvc", + "name": "Technical Impact", + "key": "TI", + "version": "1.0.0", + "values": [ + {"name": "Total","key":"T"} + ] + } + ] +} diff --git a/docker/.dockerignore b/docker/.dockerignore new file mode 100644 index 00000000..0ca7d75e --- /dev/null +++ b/docker/.dockerignore @@ -0,0 +1,17 @@ +# Ignore unnecessary files +*.pyc +*.pyo +*.log +#.gitignore +.DS_Store +# ignore all files in the following directories +#**/.git/ +**/__pycache__/ +**/node_modules/ +**/dist/ +**/build/ +*.egg-info/ +**/site/ +**/.venv/ +**/.ipynb_checkpoints/ +**/obsolete/ diff --git a/docker/Dockerfile b/docker/Dockerfile index 964af2a6..df7f668b 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,23 +1,37 @@ FROM python:3.12-slim-bookworm AS base -RUN pip install --upgrade pip +RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/* +RUN pip install --upgrade pip uv WORKDIR /app +ENV VIRTUAL_ENV=/app/.venv +ENV PATH="${VIRTUAL_ENV}/bin:${PATH}" + +RUN python -m venv "${VIRTUAL_ENV}" FROM base AS dependencies -# install requirements -COPY ../requirements.txt . -RUN pip install -r requirements.txt +ARG BASE_DIR=.. +ARG SRC_DIR=${BASE_DIR}/src + # Copy the files we need -COPY .. /app +COPY ${BASE_DIR}/ /app # Set the environment variable ENV PYTHONPATH=/app/src +COPY ${SRC_DIR}/pyproject.toml /app/src/pyproject.toml +COPY ${SRC_DIR}/uv.lock /app/src/uv.lock + +# install requirements +RUN uv sync --project=/app/src --frozen FROM dependencies AS test -# install pytest -RUN pip install pytest -# run the unit tests \ -CMD ["pytest","src/test"] +ENV PYTHONPATH=/app/src +# Install pytest and dev dependencies +RUN uv sync --project=/app/src --frozen --dev +# Run the unit tests +CMD ["uv", "run", "--project=/app/src", "pytest"] FROM dependencies AS docs -CMD ["mkdocs", "serve", "--dev-addr", "0.0.0.0:8000"] \ No newline at end of file +CMD ["uv", "run", "--project=/app/src", "mkdocs", "serve", "--dev-addr", "0.0.0.0:8000"] + +FROM dependencies AS registry_api +CMD ["uv", "run", "--project=/app/src", "uvicorn", "ssvc.api.main:app", "--host", "0.0.0.0", "--port", "8000"] \ No newline at end of file diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index 795eafb6..8f043fac 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -34,3 +34,14 @@ services: - dependencies ports: - "8000:8000" + + api: + build: + context: .. + dockerfile: docker/Dockerfile + target: registry_api + image: registry_api:latest + depends_on: + - dependencies + ports: + - "8001:8000" \ No newline at end of file diff --git a/docs/_includes/question_callout.md b/docs/_includes/question_callout.md new file mode 100644 index 00000000..00e2277e --- /dev/null +++ b/docs/_includes/question_callout.md @@ -0,0 +1,2 @@ +!!! question "Have an idea for something we missed?" + If you have suggestions for further heuristics, or potential counterexamples to these, please describe the example and reasoning in an issue on the [SSVC GitHub](https://github.com/CERTCC/SSVC/issues). diff --git a/docs/adr/0012-ssvc-namespaces.md b/docs/adr/0012-ssvc-namespaces.md new file mode 100644 index 00000000..7175b794 --- /dev/null +++ b/docs/adr/0012-ssvc-namespaces.md @@ -0,0 +1,127 @@ +--- +status: "accepted" +date: 2025-07-22 +deciders: @ahouseholer @sei-vsarvepalli +consulted: @tschmidtb51 +--- +# Use of Namespaces in SSVC objects + +## Context and Problem Statement + +We need to include decision points and other objects that are not directly +defined by the SSVC project team. For example, CVSS vector elements are a +rich source of structured data that can be used to inform SSVC decisions and +modeled as SSVC decision point objects. However, the +[FIRST CVSS SIG](https://www.first.org/cvss) owns the definition of CVSS vector +elements. So we need a way to describe these objects in SSVC format +without making them part of the SSVC specification. + +## Decision Drivers + +- Need to include decision points based on data, objects, standards, and other + definitions that are not part of the SSVC specification. +- Need to clearly distinguish between objects managed by the SSVC project and + objects provided for convenience by the SSVC project, but whose semantics are + defined by other projects or standards. + +## Considered Options + +- One big pile of objects (effectively no namespaces) +- Use namespaces to distinguish between SSVC project objects and other objects + +## Decision Outcome + +Chosen option: "Use namespaces", because + +- Clearly distinguishes between SSVC project objects and objects derived from other sources +- Allows for extension of SSVC objects with additional data from other sources +- Allows for extensions for langauages, translation, localization, etc. + +Specifically, we intend to use: + +**Registered namespaces** for objects that we create and maintain (even if they are +based on other sources). + +!!! example + + We use the `ssvc` namespace for all SSVC objects that are part of the + main project. We use the `cvss` namespace to contain CVSS vector elements. + +**Unregistered namespaces** for objects that we do not create or maintain, but +that others may want for their own use. Unregistered namespaces must start with +an `x_` prefix followed by a reverse domain name and conclude with a fragment, +such as `x_example.test#test`. +Unregistered namespaces are intended for experimental or private use. + +!!! example + + A government agency might create a set of decision points for internal use + using the `x_example.agency#internal` namespace. This allows them to use SSVC + objects of their own design alongside existig SSVC objects without needing to + register their namespace with the SSVC project. + +!!! example + + A government agency might create a set of decision points for interagency use + using the `x_example.agency#interagency` namespace. This allows them to use, + organize and share SSVC objects based on their namespace value without the + need for maintaining an external list. + +**Namespace extensions** for objects that are derived from other objects in an +registered or unregistered namespace. Extensions are not intended to be used to +introduce new objects, but rather to refine existing objects with additional data +or semantics. +Namespace extensions can be used for refining the meaning of decision point +values for a specific constituency, or adding additional nuance to +interpretation of a decision point in a specific context. + +!!! example + + An ISAO (Information Sharing and Analyzing Organization) might want to refine + the meaning of decision point values for their constituency, and could use + `ssvc//.example.isao#constituency-1` as the namespace for their collection + of extensions. + +### Consequences + +#### Positive Consequences + +- SSVC users can customize SSVC objects with additional refinements using extensions +- SSVC users can create their own SSVC objects in an unregistered namespace for + their own use, and share them with others +- Facilitates language translation and localization of SSVC objects to specific + constituencies + +#### Negative Consequences + +- Registered namespaces must be managed and maintained +- Potential for confusion if unregistered namespaces are used without care or + violating the naming conventions + + +### Confirmation + +- Regular expressions are used in the SSVC specification in both python objects + and JSON schema to validate the namespace format. +- Object validators can be used to ensure that namespaces are correctly formatted + and that registered namespaces are used for objects that are part of the SSVC + specification. + + +## Pros and Cons of the Options + +### One big pile of objects + +We started out with all objects having no namespaces, which meant that +all objects were effectively part of the SSVC specification. This was problematic +because it made it difficult to distinguish between objects that were part of the +SSVC specification under our control and objects that were derived from other sources. + +- Good, because it was simple and easy to understand +- Bad, because it made it difficult to distinguish between SSVC project objects and + objects based on specifications we neither created nor maintained + + +## More Information + +- [SSVC Namespace Documentation](../reference/code/namespaces.md) diff --git a/docs/adr/0013-ssvc-project-versions.md b/docs/adr/0013-ssvc-project-versions.md new file mode 100644 index 00000000..6b7b5d7c --- /dev/null +++ b/docs/adr/0013-ssvc-project-versions.md @@ -0,0 +1,74 @@ +--- +status: "accepted" +date: 2025-09-15 +--- +# SSVC Project Versions Follow Calendar Versioning (CalVer) + +## Context + +Individual SSVC objects (decision points, tables, etc.) use Semantic Versioning (SemVer). +For the overall SSVC project and documentation, we need a scheme that better reflects frequent, incremental updates and communicates recency to users. + +## Decision Drivers + +- Object-level changes use SemVer, but the project evolves more fluidly. +- Documentation often changes without altering underlying objects. +- Users need clear signals about how current the materials are. + +## Options + +- **CalVer** for project and documentation +- **SemVer** for project and documentation (status quo) + +## Decision + +**Chosen:** CalVer (`YYYY.MM.patch`) + +- **Major (`YYYY`) and minor (`MM`)** = release year and month + - First significant update in a month → `YYYY.M.0` (e.g., June 2025 → `2025.6.0`) +- **Patch** = subsequent updates in the same month or smaller corrections + +**Significant updates** include: + +- Adding or restructuring sections in ways that affect usability +- Adding/revising decision points, tables, or other SSVC objects +- Adding features that change how SSVC is applied + +We expect ~1–4 `YYYY.MM` releases per year, with patches as needed. +Months use single digits (`2025.6`) to keep versions concise. + +## Rationale + +CalVer suits SSVC’s character as a living framework: + +- Clearly signals recency (date in the version number) +- Fits both documentation-focused and object-focused updates +- Avoids SemVer debates over what counts as “major” or “minor” + +Individual SSVC objects will continue to use SemVer for backward compatibility. + +PyPI releases are expected to follow a similar CalVer scheme, but may include higher-resolution +date-time stamps for individual builds (e.g., `2025.6.141053`). + +## Consequences + +- **Good:** Versions clearly indicate recency and distinguish project vs. object evolution +- **Neutral:** CalVer conveys less about compatibility, but SemVer at the object level mitigates this +- **Bad:** Breaks continuity with past project-level SemVer (e.g., SSVC 1.x, 2.x) + +## Confirmation + +The CalVer scheme will be applied via Git tags and GitHub releases. + +## Alternatives Rejected + +**Continue SemVer for project/docs** + +- **Good:** Maintains continuity +- **Bad:** Cannot easily express documentation updates independent of object versions + +## References + +- [SSVC Decision Point Versioning Rules](0003-ssvc-decision-point-versioning-rules.md) +- [CalVer](https://calver.org/) +- [SemVer](https://semver.org/) diff --git a/docs/adr/index.md b/docs/adr/index.md index e99a6286..0571e67f 100644 --- a/docs/adr/index.md +++ b/docs/adr/index.md @@ -23,6 +23,8 @@ the decision records that have been made. - [0009 - Outcomes are Ordered Sets](0009-outcomes-are-ordered-sets.md) - [0010 - Outcome Sets are separate from Decision Point Groups](0010-outcome-sets-are-separate-from-decision-point-groups.md) - [0011 - Correspondence between Automatable v2.0.0, Value Density v1.0.0, and CVSS v4](0011-automatable-and-value-density-and-CVSSv4.md) +- [0012 - SSVC Namespaces](0012-ssvc-namespaces.md) +- [0013 - SSVC Project Versions](0013-ssvc-project-versions.md) ## Rejected Records diff --git a/docs/howto/acuity_ramp.md b/docs/howto/acuity_ramp.md index ef1ae271..314c2059 100644 --- a/docs/howto/acuity_ramp.md +++ b/docs/howto/acuity_ramp.md @@ -92,7 +92,7 @@ data collection and analysis capabilities increase. We demonstrate this with the into their decision model. ```python exec="true" idprefix="" - from ssvc.decision_points.exploitation import LATEST + from ssvc.decision_points.ssvc.exploitation import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) @@ -105,7 +105,7 @@ data collection and analysis capabilities increase. We demonstrate this with the incorporate the `SYSTEM_EXPOSURE_1_0_1` decision point into their decision model. ```python exec="true" idprefix="" - from ssvc.decision_points.system_exposure import LATEST + from ssvc.decision_points.ssvc.system_exposure import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) @@ -121,7 +121,7 @@ data collection and analysis capabilities increase. We demonstrate this with the or by translating CVSS v3 or v4 scores into a value for this decision point. ```python exec="true" idprefix="" - from ssvc.decision_points.automatable import LATEST + from ssvc.decision_points.ssvc.automatable import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) @@ -134,8 +134,8 @@ data collection and analysis capabilities increase. We demonstrate this with the `MISSION_IMPACT_2` and `SAFETY_IMPACT_1` decision points into their decision model. ```python exec="true" idprefix="" - from ssvc.decision_points.mission_impact import LATEST as MI - from ssvc.decision_points.safety_impact import LATEST as SI + from ssvc.decision_points.ssvc.mission_impact import LATEST as MI + from ssvc.decision_points.ssvc.safety_impact import LATEST as SI from ssvc.doc_helpers import example_block diff --git a/docs/howto/bootstrap/_steps_table.md b/docs/howto/bootstrap/_steps_table.md index 01c6e98e..a1ed4939 100644 --- a/docs/howto/bootstrap/_steps_table.md +++ b/docs/howto/bootstrap/_steps_table.md @@ -1,6 +1,6 @@ -| Step | Description | -| ---- |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [**Prepare**](prepare.md) | Define the decision you want to make, the outcomes you care about, the decision points you will use to make the decision, the decision policy, the data you need to inform the decision points, and the process for maintaining your decision model. | -| [**Collect**](collect.md) | Collect the data you need to make informed decisions. | -| [**Use SSVC**](use.md) | Use SSVC to make decisions about how to respond to vulnerabilities. | -| [**Respond**](use.md) | Respond to vulnerabilities according to the prioritization. | +| Step | Description | +| ---- |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| [**Prepare**](prepare.md) | Define the decision you want to make, the outcomes you care about, the decision points you will use to make the decision, the decision table, the data you need to inform the decision points, and the process for maintaining your decision model. | +| [**Collect**](collect.md) | Collect the data you need to make informed decisions. | +| [**Use SSVC**](use.md) | Use SSVC to make decisions about how to respond to vulnerabilities. | +| [**Respond**](use.md) | Respond to vulnerabilities according to the prioritization. | diff --git a/docs/howto/bootstrap/prepare.md b/docs/howto/bootstrap/prepare.md index 79f144ea..f4971120 100644 --- a/docs/howto/bootstrap/prepare.md +++ b/docs/howto/bootstrap/prepare.md @@ -1,13 +1,13 @@ # Prepare to Use SSVC Preparing to use SSVC involves defining a decision you want to make, -the information you need to make that decision, and the policy you want to use to make that decision. +the information you need to make that decision, and the decision table you want to use to make that decision. !!! tip "Stakeholder Involvement" Multiple organizational stakeholders should be involved in the SSVC adoption process. - - _Risk Owners_ must be involved in the development of the risk management policy represented by SSVC. + - _Risk Owners_ must be involved in the development of the risk management decision table represented by SSVC. - _Vulnerability Management_ stakeholders, including IT Security and IT Service Management (ITSM), should be involved in the decision modeling and data mapping processes as well. - _Other Roles_ depend on the organization and specific decision models being developed. For example, a Supplier @@ -32,8 +32,8 @@ flowchart decisionpoints[Define Inputs] dataeng[Data Mapping] dm[/Data Map/] - policy[Policy Development] - p[/Policy/] + policy[Decision Table Development] + p[/Decision Table/] end dcd --> outcomes dcd --> governance @@ -181,18 +181,18 @@ flowchart LR device safety regulations. So, the medical device manufacturer might define a decision point called _Regulated_ with the values _Regulated Device_, _Non-Regulated Device_, and _Support Service_. -## Define Policy +## Define Decision Table So far, you have chosen a decision to model, defined the possible outcomes for that decision, and defined the information you need to make that decision. -Now, you need to define the policy you want to use to make that decision. -A policy is a function that takes a set of decision point values as input and returns an outcome as output. -While we often choose to represent policies as decision trees, they can be represented in other ways as well. -In fact, we find that it is often useful to represent policies in tabular form, for example as a CSV file. -We have provided a number of example policies in the [SSVC documentation](../index.md), but you can define your own policy to meet your needs. +Now, you need to define the decision table you want to use to make that decision. +A decision table is a function that takes a set of decision point values as input and returns an outcome as output. +While we often choose to represent decision tables as decision trees, they can be represented in other ways as well. +In fact, we find that it is often useful to represent decision tables in tabular form, for example as a CSV file. +We have provided a number of example decision tables in the [SSVC documentation](../index.md), but you can define your own decision table to meet your needs. ```mermaid --- -title: Policy Definition Process +title: Decision Table Definition Process --- flowchart LR subgraph do[Define Outcomes] @@ -201,9 +201,9 @@ flowchart LR subgraph di [Define Inputs] dps[/Decision Point Set/] end - subgraph policy [Policy Development] - dfp{{Define Policy}} - p[/Policy/] + subgraph policy [Decision Table Development] + dfp{{Define Decision Table}} + p[/Decision Table/] end oc --> dfp dps --> dfp @@ -217,10 +217,10 @@ flowchart LR decision model and decide that both the outcome set and the decision point set that define the structure of the decision model are appropriate for their needs. They map the 48 hour requirement to the _Immediate_ outcome, because it essentially represents their highest priority response. - However, they notice that the specific policy given in the [Deployer Prioritization](../supplier_tree.md) + However, they notice that the specific decision table given in the [Deployer Prioritization](../supplier_tree.md) example—that is, the mapping from decision point values to outcomes—is not appropriate for their needs because it has too few _Immediate_ outcomes to suit their policy. - Therefore, the bank decides to reuse the same decision point set and outcome set but define their own policy. + Therefore, the bank decides to reuse the same decision point set and outcome set but define their own decision table. ## Map Data to Model Inputs @@ -298,10 +298,10 @@ SSVC. Each of the items we discussed above could be reviewed in turn, ensuring t - The decision itself remains relevant to the organization - The outcomes remain relevant to the decision - The decision points remain relevant to the decision -- The policy remains relevant to the organization's needs +- The decision table remains relevant to the organization's needs - The data sources remain relevant to informing the decision points -Depending on the review, any necessary adjustments can be made to the outcomes, decision points, policy, data map, +Depending on the review, any necessary adjustments can be made to the outcomes, decision points, decision table, data map, or operational processes. ```mermaid @@ -314,13 +314,13 @@ subgraph Governance direction LR ro[/Modify Outcomes?\] mdp[/Modify Decision Points?\] - rp[/Modify Policy?\] + rp[/Modify Decision Table?\] rds[/Modify Data Mapping?\] oc[/Outcomes/] dp[/Decision Points/] dm[/Data Map/] - um{{Update Policy}} - po[/Policy/] + um{{Update Decision Table}} + po[/Decision Table/] end ro -->|yes| oc @@ -355,10 +355,10 @@ um --> po - Are there decision points that are not as useful as we thought they would be? - Are there new decision points we should add? - - Does the policy still reflect our understanding and expectations of how we want to make this decision? + - Does the decision table still reflect our understanding and expectations of how we want to make this decision? - - Have there been instances where the policy has led to a decision that we later regretted? - - Are there new constraints or requirements that the policy mapping does not capture? + - Have there been instances where the decision table has led to a decision that we later regretted? + - Are there new constraints or requirements that the decision table mapping does not capture? - Do we have the right data to inform the decision points in the decision model? diff --git a/docs/howto/bootstrap/summary.md b/docs/howto/bootstrap/summary.md index 1de97b42..f5e33b69 100644 --- a/docs/howto/bootstrap/summary.md +++ b/docs/howto/bootstrap/summary.md @@ -39,9 +39,9 @@ subgraph prep [Prepare to use SSVC] ddf[/Data Definition/] end l7((1)) - subgraph policy [Policy Development] - dfp{{Define Policy}} - p[/Policy/] + subgraph policy [Decision Table Development] + dfp{{Define Decision Table}} + p[/Decision Table/] end subgraph gov [Governance] eg{{Establish Governance Process}} @@ -60,7 +60,7 @@ end subgraph runtime [Use SSVC] mdp[[Apply Decision Point Mapping to Data]] dp[/Decision Point Values/] - ap[[Apply Policy]] + ap[[Apply Decision Table]] oc[/Outcome/] end r[Vulnerability Response] diff --git a/docs/howto/bootstrap/use.md b/docs/howto/bootstrap/use.md index 6b75cba6..9625fc5a 100644 --- a/docs/howto/bootstrap/use.md +++ b/docs/howto/bootstrap/use.md @@ -5,8 +5,8 @@ SSVC to make decisions about how to respond to vulnerabilities. ```mermaid flowchart LR - subgraph pd[Policy Development] - p[/Policy/] + subgraph pd[Decision Table Development] + p[/Decision Table/] end subgraph dmp[Data Mapping] dm[/Data Map/] @@ -18,7 +18,7 @@ flowchart LR subgraph runtime [Use SSVC] mdp[[Apply Decision Point Mapping to Data]] dp[/Decision Point Values/] - ap[[Apply Policy]] + ap[[Apply Decision Table]] oc[/Outcome/] end dm --> mdp @@ -42,14 +42,14 @@ flowchart LR matches their existing process. These same requirements also led them to define a decision function based on a custom selection of existing decision points. - They've mapped their agency policy to a decision policy that assigns specific decision point values to specific outcomes. + They've mapped their agency policy to a decision table that assigns specific decision point values to specific outcomes. They have also enumerated the data they need to inform the relevant decision point values. The agency has a process for collecting the data they need, and they have collected the data for a particular vulnerability. Now they are ready to use SSVC to decide how to respond to a vulnerability. Taking the data they have collected, they first combine it with the data map to produce a set of decision point values. - Then they apply the policy to the decision point values to produce an outcome. + Then they apply the decision table to the decision point values to produce an outcome. The outcome is a prioritization decision that they can use to inform their response to the vulnerability. ## Respond to Vulnerabilities @@ -138,7 +138,7 @@ If the analyst knows nothing, all states are possible. For example, [Utility](../../reference/decision_points/utility.md) may be [laborious](../../reference/decision_points/utility.md), [efficient](../../reference/decision_points/utility.md), or [super effective](../../reference/decision_points/system_exposure.md). ```python exec="true" idprefix="" - from ssvc.decision_points.utility import LATEST + from ssvc.decision_points.ssvc.utility import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) @@ -155,14 +155,14 @@ The merit in this “list all values” approach emerges when the stakeholder kn Extending the previous example, say the analyst knows that [*Value Density*](../../reference/decision_points/value_density.md) is [diffuse](../../reference/decision_points/value_density.md) but does not know the value for [Automatability](../../reference/decision_points/automatable.md). ```python exec="true" idprefix="" - from ssvc.decision_points.value_density import LATEST + from ssvc.decision_points.ssvc.value_density import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` ```python exec="true" idprefix="" - from ssvc.decision_points.automatable import LATEST + from ssvc.decision_points.ssvc.automatable import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) diff --git a/docs/howto/coordination_triage_decision.md b/docs/howto/coordination_triage_decision.md index 6ad72cdc..65e5912e 100644 --- a/docs/howto/coordination_triage_decision.md +++ b/docs/howto/coordination_triage_decision.md @@ -28,13 +28,13 @@ SSVC can be applied to either the initial report or to the results of such refin We take three priority levels in our decision about whether and how to [coordinate](https://certcc.github.io/CERT-Guide-to-CVD/tutorials/cvd_is_a_process/) a vulnerability based on an incoming report: -!!! info "Coordinator Triage Priority" +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.coord_triage import LATEST as DT +from ssvc.doc_helpers import example_block - | Triage Priority | Description | - | :--- | :---------- | - | Decline | Do not act on the report. | - | Track | Receive information about the vulnerability and monitor for status changes but do not take any overt actions. | - | Coordinate | Take action on the report. “Action” may include any one or more of: technical analysis, reproduction, notifying vendors, publication, and assist another party. | +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` - *Decline* — Do not act on the report. May take different forms, including ignoring the report as well as an acknowledgement to the reporter that we will not act and suggest the reporter to go to vendor or publish if unresponsive. @@ -42,8 +42,12 @@ a vulnerability based on an incoming report: - *Coordinate* — Take action on the report. “Action” may include any one or more of: technical analysis, reproduction, notifying vendors, lead coordination (notify, communicate, and publish), publish only (amplify public message), advise only, secondary coordinator (assist another lead coordinator). - See the [FIRST CSIRT Services Framework](https://www.first.org/standards/frameworks/csirts/csirt_services_framework_v2.1#7-Service-Area-Vulnerability-Management) - for additional vulnerability management services a coordinator may provide. + +!!! tip "FIRST CSIRT Services Framework" + + The [FIRST CSIRT Services Framework](https://www.first.org/standards/frameworks/csirts/csirt_services_framework_v2.1#7-Service-Area-Vulnerability-Management) + describes the services that a coordinator may provide in the area of vulnerability management. + It includes services such as vulnerability coordination, vulnerability analysis, and vulnerability reporting. ## Coordinator Triage Decision Points @@ -82,22 +86,16 @@ The remaining five decision points are: More detail about each of these decision points is provided at the links above, here we provide a brief summary of each. ```python exec="true" idprefix="" -from ssvc.decision_points.report_public import LATEST as RP -from ssvc.decision_points.supplier_contacted import LATEST as SC -from ssvc.decision_points.report_credibility import LATEST as RC -from ssvc.decision_points.supplier_cardinality import LATEST as SI -from ssvc.decision_points.supplier_engagement import LATEST as SE -from ssvc.decision_points.utility import LATEST as U -from ssvc.decision_points.public_safety_impact import LATEST as PSI +from ssvc.decision_tables.ssvc.coord_triage import LATEST as DT from ssvc.doc_helpers import example_block -for dp in [RP, SC, RC, SI, SE, U, PSI]: +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: print(example_block(dp)) ``` ## Coordinator Triage Decision Model -The following example decision model is a policy that closely follows our own decision model at the CERT/CC. +The following example decision model is a decision table that closely follows our own decision model at the CERT/CC. Other coordinators should consider customizing the tree to their needs, as described in [Tree Construction and Customization Guidance](tree_customization.md). !!! tip "SSVC Customization in Action: CISA" @@ -105,13 +103,30 @@ Other coordinators should consider customizing the tree to their needs, as descr CISA has customized an SSVC decision model to suit their coordination needs. It is available at [https://www.cisa.gov/ssvc](https://www.cisa.gov/ssvc). - +### Decision Model Visualization + +The following diagram shows the decision model for the coordinator triage decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.coord_triage import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` ### Table of Values +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + {% include-markdown "../_includes/_scrollable_table.md" heading-offset=1 %} - -{{ read_csv('coord-triage-options.csv') }} +```python exec="true" idprefix="" + +from ssvc.decision_tables.ssvc.coord_triage import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/cvss_v4/eq1.md b/docs/howto/cvss_v4/eq1.md new file mode 100644 index 00000000..6a6733fb --- /dev/null +++ b/docs/howto/cvss_v4/eq1.md @@ -0,0 +1,65 @@ +# CVSS v4 Equivalence Set EQ1 + +Here we describe an example decision model for an analyst assessing the CVSS v4 +equivalence set EQ1. + +## Analyst Units of Work + +!!! info inline end "Analyst Unit of Work" + + The unit of work for an Analyst is a single vulnerability report. + +Analysts are usually tasked with assessing the CVSS score for an individual +vulnerability report. + +## Analyst Decision Outcomes + +The analyst's decision is to choose the appropriate level for CVSS v4 EQ1. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_one import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` + +## Analyst Decision Points + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_one import LATEST as DT +from ssvc.doc_helpers import example_block + +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) +``` + +## Analyst Decision Model + +Below we provide an example deployer prioritization decision table that maps the decision points just listed to the outcomes described above. + +### Decision Model Visualization + +The following diagram shows the decision model for the EQ1 decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_one import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +### Table of Values + +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" + +from ssvc.decision_tables.cvss.equivalence_set_one import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/cvss_v4/eq2.md b/docs/howto/cvss_v4/eq2.md new file mode 100644 index 00000000..c0e8b3a1 --- /dev/null +++ b/docs/howto/cvss_v4/eq2.md @@ -0,0 +1,65 @@ +# CVSS v4 Equivalence Set EQ2 + +Here we describe an example decision model for an analyst assessing the CVSS v4 +equivalence set EQ2. + +## Analyst Units of Work + +!!! info inline end "Analyst Unit of Work" + + The unit of work for an Analyst is a single vulnerability report. + +Analysts are usually tasked with assessing the CVSS score for an individual +vulnerability report. + +## Analyst Decision Outcomes + +The analyst's decision is to choose the appropriate level for CVSS v4 EQ2. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_two import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` + +## Analyst Decision Points + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_two import LATEST as DT +from ssvc.doc_helpers import example_block + +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) +``` + +## Analyst Decision Model + +Below we provide an example deployer prioritization decision table that maps the decision points just listed to the outcomes described above. + +### Decision Model Visualization + +The following diagram shows the decision model for the EQ2 decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_two import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +### Table of Values + +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" + +from ssvc.decision_tables.cvss.equivalence_set_two import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/cvss_v4/eq3.md b/docs/howto/cvss_v4/eq3.md new file mode 100644 index 00000000..dd72315b --- /dev/null +++ b/docs/howto/cvss_v4/eq3.md @@ -0,0 +1,65 @@ +# CVSS v4 Equivalence Set EQ3 + +Here we describe an example decision model for an analyst assessing the CVSS v4 +equivalence set EQ3. + +## Analyst Units of Work + +!!! info inline end "Analyst Unit of Work" + + The unit of work for an Analyst is a single vulnerability report. + +Analysts are usually tasked with assessing the CVSS score for an individual +vulnerability report. + +## Analyst Decision Outcomes + +The analyst's decision is to choose the appropriate level for CVSS v4 EQ3. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_three import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` + +## Analyst Decision Points + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_three import LATEST as DT +from ssvc.doc_helpers import example_block + +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) +``` + +## Analyst Decision Model + +Below we provide an example deployer prioritization decision table that maps the decision points just listed to the outcomes described above. + +### Decision Model Visualization + +The following diagram shows the decision model for the EQ3 decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_three import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +### Table of Values + +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" + +from ssvc.decision_tables.cvss.equivalence_set_three import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/cvss_v4/eq4.md b/docs/howto/cvss_v4/eq4.md new file mode 100644 index 00000000..b4ce4e89 --- /dev/null +++ b/docs/howto/cvss_v4/eq4.md @@ -0,0 +1,65 @@ +# CVSS v4 Equivalence Set EQ4 + +Here we describe an example decision model for an analyst assessing the CVSS v4 +equivalence set EQ4. + +## Analyst Units of Work + +!!! info inline end "Analyst Unit of Work" + + The unit of work for an Analyst is a single vulnerability report. + +Analysts are usually tasked with assessing the CVSS score for an individual +vulnerability report. + +## Analyst Decision Outcomes + +The analyst's decision is to choose the appropriate level for CVSS v4 EQ4. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_four import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` + +## Analyst Decision Points + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_four import LATEST as DT +from ssvc.doc_helpers import example_block + +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) +``` + +## Analyst Decision Model + +Below we provide an example deployer prioritization decision table that maps the decision points just listed to the outcomes described above. + +### Decision Model Visualization + +The following diagram shows the decision model for the EQ4 decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_four import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +### Table of Values + +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" + +from ssvc.decision_tables.cvss.equivalence_set_four import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/cvss_v4/eq5.md b/docs/howto/cvss_v4/eq5.md new file mode 100644 index 00000000..4e6526f8 --- /dev/null +++ b/docs/howto/cvss_v4/eq5.md @@ -0,0 +1,65 @@ +# CVSS v4 Equivalence Set EQ5 + +Here we describe an example decision model for an analyst assessing the CVSS v4 +equivalence set EQ5. + +## Analyst Units of Work + +!!! info inline end "Analyst Unit of Work" + + The unit of work for an Analyst is a single vulnerability report. + +Analysts are usually tasked with assessing the CVSS score for an individual +vulnerability report. + +## Analyst Decision Outcomes + +The analyst's decision is to choose the appropriate level for CVSS v4 EQ5. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_five import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` + +## Analyst Decision Points + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_five import LATEST as DT +from ssvc.doc_helpers import example_block + +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) +``` + +## Analyst Decision Model + +Below we provide an example deployer prioritization decision table that maps the decision points just listed to the outcomes described above. + +### Decision Model Visualization + +The following diagram shows the decision model for the EQ5 decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_five import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +### Table of Values + +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" + +from ssvc.decision_tables.cvss.equivalence_set_five import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/cvss_v4/eq6.md b/docs/howto/cvss_v4/eq6.md new file mode 100644 index 00000000..51885845 --- /dev/null +++ b/docs/howto/cvss_v4/eq6.md @@ -0,0 +1,65 @@ +# CVSS v4 Equivalence Set EQ6 + +Here we describe an example decision model for an analyst assessing the CVSS v4 +equivalence set EQ6. + +## Analyst Units of Work + +!!! info inline end "Analyst Unit of Work" + + The unit of work for an Analyst is a single vulnerability report. + +Analysts are usually tasked with assessing the CVSS score for an individual +vulnerability report. + +## Analyst Decision Outcomes + +The analyst's decision is to choose the appropriate level for CVSS v4 EQ6. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_six import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` + +## Analyst Decision Points + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_six import LATEST as DT +from ssvc.doc_helpers import example_block + +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) +``` + +## Analyst Decision Model + +Below we provide an example deployer prioritization decision table that maps the decision points just listed to the outcomes described above. + +### Decision Model Visualization + +The following diagram shows the decision model for the EQ6 decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.equivalence_set_six import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +### Table of Values + +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" + +from ssvc.decision_tables.cvss.equivalence_set_six import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/cvss_v4/index.md b/docs/howto/cvss_v4/index.md new file mode 100644 index 00000000..710eded3 --- /dev/null +++ b/docs/howto/cvss_v4/index.md @@ -0,0 +1,105 @@ +# CVSS v4 Assessment With SSVC + +[CVSS v4](https://www.first.org/cvss/v4-0/specification-document) introduces an +updated scoring system that includes several metric groupings referred to +as *Equivalence Sets*. +In SSVC, we can model these individual equivalence sets as decision tables +that can be used by analysts to assess each equivalence set value based on +its component metrics (which we have mapped into SSVC decision points). + +An Analyst can use these decision tables to assess the CVSS v4 equivalence set +values based either on their own assessments or by using a CVSS v4 vector published +by another source. + +!!! question "I thought SSVC and CVSS were different?" + + SSVC and CVSS are indeed different, but they can be used together. + We do not see SSVC as a replacement for CVSS, but rather as a complementary + decision-making framework that can help stakeholders make a variety of + vulnerability response decisions. + In fact, we're very interested in using CVSS vector elements as inputs to + SSVC decision tables to help stakeholders make more informed prioritization + decisions that leverage the community's understanding of a vulnerability's + characteristics and impact assessments. + In the future, we hope to see more SSVC decision tables that are + directly informed by CVSS vectors, allowing analysts to use SSVC to + create a broader set of decision models that incorporate CVSS vector + elements as inputs. + +## CVSS v4 Equivalence Sets + +Here we provide the decision points for each of the CVSS v4 equivalence sets. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.qualitative_severity import LATEST as DT +from ssvc.doc_helpers import example_block + +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) +``` + +We provide a detailed decision table for each equivalence set in the pages that follow: + +- [CVSS v4 Equivalence Set EQ1](eq1.md) +- [CVSS v4 Equivalence Set EQ2](eq2.md) +- [CVSS v4 Equivalence Set EQ3](eq3.md) +- [CVSS v4 Equivalence Set EQ4](eq4.md) +- [CVSS v4 Equivalence Set EQ5](eq5.md) +- [CVSS v4 Equivalence Set EQ6](eq6.md) + +## CVSS v4 Qualitative Severity Rating + +Finally, CVSS v4 provides a *Qualitative Severity Rating* that maps the six equivalence +sets into a single qualitative rating (None, Low, Medium, High, Critical). + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.qualitative_severity import LATEST as DT +from ssvc.doc_helpers import example_block +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` + +A full decision model for the CVSS v4 Qualitative Severity Rating can be found +in the [CVSS v4 Qualitative Severity Rating](qualitative.md) page. + +!!! question "What about CVSS v4 *MacroVectors*?" + + CVSS v4 _MacroVectors_ are a new addition in CVSS v4 that provide a way to + map the six equivalence sets into a single vector value that can be used + to assign a CVSS v4 base score. + In our implementation here, we simply model the MacroVector as another decision + table that takes the individual equivalence set outcomes as inputs and provides + the Qualitative Severity Rating as its outcome. + +!!! question "How are CVSS v4 scores handled?" + + We do not provide numerical CVSS v4 scores in this implementation. + The CVSS v4 specification defines a + [lookup table](https://github.com/FIRSTdotorg/cvss-v4-calculator/blob/main/cvss_lookup.js) + and a complex algorithm to compute a score between 0.0 and 10.0 based on + equivalence set values and the CVSS v4 vector. + + In practice, many analysts convert numerical scores into qualitative + severity ratings, such as None, Low, Medium, High, or Critical: + + | Numerical Score | Qualitative Severity Rating | + |-----------------|----------------------------| + | 0.0 | None | + | 0.1 - 3.9 | Low | + | 4.0 - 6.9 | Medium | + | 7.0 - 8.9 | High | + | 9.0 - 10.0 | Critical | + + One of our [original concerns](https://doi.ieeecomputersociety.org/10.1109/MSEC.2020.3044475) + about CVSS v3—and still relevant in CVSS v4—was that numerical scores were + often misused or misinterpreted, leading to poor prioritization decisions. + To avoid this, we focus on mapping equivalence set values directly to + qualitative severity ratings, which is the outcome many organizations actually + care about. + + Using SSVC, we can model the same assessment process that an analyst would + use with CVSS v4, but entirely bypass the numerical score. + The logic is identical: given a set of equivalence values, SSVC produces the + same qualitative severity rating as the [CVSS v4 Calculator](https://www.first.org/cvss/calculator/4-0). + This demonstrates that numerical scores are not + necessary for effective prioritization or decision-making. diff --git a/docs/howto/cvss_v4/qualitative.md b/docs/howto/cvss_v4/qualitative.md new file mode 100644 index 00000000..f221c20b --- /dev/null +++ b/docs/howto/cvss_v4/qualitative.md @@ -0,0 +1,117 @@ +# CVSS v4 Qualitative Severity Rating + +Here we describe an example decision model for an analyst assessing the CVSS v4 +Qualitative Severity Rating. +In our decision model, we assume that the analyst has already assessed the +vulnerability report against the CVSS v4 Equivalence Sets: + +- EQ1: [CVSS v4 Equivalence Set 1](eq1.md) +- EQ2: [CVSS v4 Equivalence Set 2](eq2.md) +- EQ3: [CVSS v4 Equivalence Set 3](eq3.md) +- EQ4: [CVSS v4 Equivalence Set 4](eq4.md) +- EQ5: [CVSS v4 Equivalence Set 5](eq5.md) +- EQ6: [CVSS v4 Equivalence Set 6](eq6.md) + +and is now ready to assign a qualitative severity rating based on the outcomes +of those equivalence sets. + +!!! info "How we modeled the CVSS v4 Qualitative Severity Rating" + + The CVSS v4 specification provides a + [mapping](https://github.com/FIRSTdotorg/cvss-v4-calculator/blob/main/cvss_lookup.js) + from each CVSS v4 *MacroVector* (made up of the six equivalence set selections) + to a numerical score between 0.0 and 10.0. + CVSS has traditionally provided the following mapping from numerical score + ranges to qualitative severity ratings: + + | Numerical Score | Qualitative Severity Rating | + |------------------|-----------------------------| + | 0.0 | None | + | 0.1 - 3.9 | Low | + | 4.0 - 6.9 | Medium | + | 7.0 - 8.9 | High | + + In our implementation, we just skip the numerical score step and go directly + from the equivalence set outcomes to the qualitative severity rating that + corresponds to the numerical score in the lookup table linked above. + +## Analyst Units of Work + +!!! info inline end "Analyst Unit of Work" + + The unit of work for an Analyst is a single vulnerability report. + +Analysts are usually tasked with assessing the CVSS score for an individual +vulnerability report. + +## Analyst Decision Outcomes + +The analyst's decision is to choose the appropriate level for the CVSS v4 Qualitative Severity Rating. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.qualitative_severity import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` + +## Analyst Decision Points + +Each of these decision points corresponds to the outcome of one of the six equivalence set +decision tables. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.qualitative_severity import LATEST as DT +from ssvc.doc_helpers import example_block + +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) +``` + +## Analyst Decision Model + +Below we provide an example deployer prioritization decision table that maps the decision points just listed to the outcomes described above. + +### Decision Model Visualization + +The following diagram shows the decision model for the Qualitative Severity Rating decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.cvss.qualitative_severity import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) + +# filter rows for invalid +def invalid(row): + if row["cvss:EQ3:1.0.0"] == "L" and row["cvss:EQ6:1.0.0"] == "H": + return True + return False + +rows = [row for row in rows if not invalid(row)] +print(mapping2mermaid(rows, title=title)) +``` + +### Table of Values + +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" + +from ssvc.decision_tables.cvss.qualitative_severity import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +# filter rows for invalid (these don't affect the outcome because they're +# unreachable from valid CVSS vectors) +def invalid(row): + if row["cvss:EQ3:1.0.0"] == "L" and row["cvss:EQ6:1.0.0"] == "H": + return True + return False + +DT.mapping = [row for row in DT.mapping if not invalid(row)] + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/deployer_tree.md b/docs/howto/deployer_tree.md index 961a475e..09c4a777 100644 --- a/docs/howto/deployer_tree.md +++ b/docs/howto/deployer_tree.md @@ -48,14 +48,22 @@ A deployer's decision centers on with what priority to deploy a given remediatio Similar to the [Supplier](supplier_tree.md) case, we consider four categories of priority, as outlined in the table below. While we've used the same priority names, the meaning of the priority may have different implications for the deployer than for the supplier. -!!! note "Patch Deployer Priority" +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.deployer_dt import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` - | Deployer Priority | Description | - | :--- | :---------- | - | Defer | Do not act at present. | - | Scheduled | Act during regularly scheduled maintenance time. | - | Out-of-cycle | Act more quickly than usual to apply the mitigation or remediation out-of-cycle, during the next available opportunity, working overtime if necessary. | - | Immediate | Act immediately; focus all resources on applying the fix as quickly as possible, including, if necessary, pausing regular organization operations. | +A more specific interpretation for the priority levels for deployers is as follows: + +| Deployer Priority | Description | +| :--- | :---------- | +| Defer | Do not act at present. | +| Scheduled | Act during regularly scheduled maintenance time. | +| Out-of-cycle | Act more quickly than usual to apply the mitigation or remediation out-of-cycle, during the next available opportunity, working overtime if necessary. | +| Immediate | Act immediately; focus all resources on applying the fix as quickly as possible, including, if necessary, pausing regular organization operations. | When remediation is available, usually the action is to apply it. When remediation is not yet available, the action space is more diverse, but it should involve mitigating the vulnerability @@ -113,13 +121,10 @@ The Deployer Patch Deployment Priority decision model uses the following decisio More detail about each of these decision points is provided at the links above, here we provide a brief summary of each. ```python exec="true" idprefix="" -from ssvc.decision_points.exploitation import LATEST as EXP -from ssvc.decision_points.system_exposure import LATEST as SE -from ssvc.decision_points.utility import LATEST as U -from ssvc.decision_points.human_impact import LATEST as HI +from ssvc.decision_tables.ssvc.deployer_dt import LATEST as DT from ssvc.doc_helpers import example_block -for dp in [EXP, SE, U, HI]: +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: print(example_block(dp)) ``` @@ -127,23 +132,37 @@ In the *Human Impact* table above, *MEF* stands for Mission Essential Function. ## Deployer Decision Model -Below we provide an example deployer prioritization policy that maps the decision points just listed to the outcomes described above. +Below we provide an example deployer prioritization decision table that maps the decision points just listed to the outcomes described above. -!!! tip "Notes on the Deployer Decision Model Example Policy" +!!! tip "Notes on the Deployer Decision Model Example Decision Table" - In the example policy shown below: + In the example decision table shown below: - An [_active_](../reference/decision_points/exploitation.md) state of [*Exploitation*](../reference/decision_points/exploitation.md) will never result in a *defer* priority. - A [_none_](../reference/decision_points/exploitation.md) state of [*Exploitation*](../reference/decision_points/exploitation.md) (no evidence of exploitation) will result in either *defer* or *scheduled* priority—unless the state of [*Human Impact*](../reference/decision_points/human_impact.md) is [_very high_](../reference/decision_points/human_impact.md), resulting in an *out-of-cycle* priority. -{% include-markdown "../_includes/_tree_notation_tip.md" %} +### Decision Model Visualization + +The following diagram shows the decision model for the deployer decision. + +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.deployer_dt import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt - +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` ### Table of Values - -{{ read_csv('deployer-options.csv') }} +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" + +from ssvc.decision_tables.ssvc.deployer_dt import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/gathering_info/automatable.md b/docs/howto/gathering_info/automatable.md new file mode 100644 index 00000000..d8ba917c --- /dev/null +++ b/docs/howto/gathering_info/automatable.md @@ -0,0 +1,22 @@ +# Gathering Information about Automatable + +``` python exec="true" idprefix="" +from ssvc.decision_points.ssvc.automatable import LATEST +from ssvc.doc_helpers import example_block + +print(example_block(LATEST)) +``` + +An analyst should be able to sketch the automation scenario and how it either does or does not satisfy each of the four kill chain steps. +Once one step is not satisfied, the analyst can stop and select [*no*](automatable.md). +Code that demonstrably automates all four kill chain steps certainly satisfies as a sketch. +We say sketch to indicate that plausible arguments, such as convincing psuedocode of an automation pathway for each step, are also adequate evidence in favor of a [*yes*](automatable.md) to *Automatable*. + +Like all SSVC decision points, *Automatable* should capture the analyst's best understanding of plausible scenarios at the time of the analysis. +An answer of *no* does not mean that it is absolutely inconceivable to automate exploitation in any scenario. +It means the analyst is not able to sketch a plausible path through all four kill chain steps. +“Plausible” sketches should account for widely deployed network and host-based defenses. +Liveness of Internet-connected services means quite a few overlapping things [@bano2018scanning]. +For most vulnerabilities, an open port does not automatically mean that reconnaissance, weaponization, and delivery are automatable. +Furthermore, discovery of a vulnerable service is not automatable in a situation where only two hosts are misconfigured to expose the service out of 2 million hosts that are properly configured. +As discussed in in [Reasoning Steps Forward](../../topics/scope.md), the analyst should consider *credible* effects based on *known* use cases of the software system to be pragmatic about scope and providing values to decision points. diff --git a/docs/howto/gathering_info/exploitation.md b/docs/howto/gathering_info/exploitation.md new file mode 100644 index 00000000..9b391a52 --- /dev/null +++ b/docs/howto/gathering_info/exploitation.md @@ -0,0 +1,39 @@ +# Gathering Information About Exploitation + +```python exec="true" idprefix="" +from ssvc.decision_points.ssvc.exploitation import LATEST +from ssvc.doc_helpers import example_block + +print(example_block(LATEST)) +``` + +## Public PoC +[Historical Analysis of Exploit Availability Timelines](https://dl.acm.org/doi/10.5555/3485754.3485760) presents a method for searching the GitHub repositories of open-source exploit databases. +This method could be employed to gather information about whether *PoC* is true. +However, part (3) of *PoC* would not be represented in such a search, so more information gathering would be needed. +For part (3), one approach is to construct a mapping of CWE-IDs which +always represent vulnerabilities with well-known methods of exploitation. +We provide a list of possible CWE-IDs for this purpose at the [bottom of this page.](./#cwe-with-poc-examples-list) + +!!! note "EPSS Scoring" + The Exploit Prediction Scoring System (EPSS) estimates the likelihood of of a Public PoC. See [this page](../../using_epss) for more information on incorporating EPSS scoring to your SSVC model. + +## Active +Gathering information for *active* is a bit harder. +If the vulnerability has a name or public identifier (such as a CVE-ID), a search of news websites, Twitter, the vendor's vulnerability description, and public vulnerability databases for mentions of exploitation is generally adequate. +However, if the organization has the ability to detect exploitation attempts—for instance, through reliable and precise IDS signatures based on a public *PoC*—then detection of exploitation attempts also signals that *active* is the right choice. +Determining which vulnerability a novel piece of malware uses may be time consuming, requiring reverse engineering and a lot of trial and error. +Additionally, capable incident detection and analysis capabilities are required to make reverse engineering possible. +Because most organizations do not conduct these processes fully for most incidents, information about which vulnerabilities are being actively exploited generally comes from public reporting by organizations that do conduct these processes. +As long as those organizations also share detection methods and signatures, the results are usually quickly corroborated by the community. +For these reasons, we assess public reporting by established security community members to be a good information source for *active*; however, one should not assume it is complete. + +## None +The description for *none* says that there is no **evidence** of *active* exploitation. +This framing admits that an analyst may not be able to detect or know about every attack. +Acknowledging that *Exploitation* values can change relatively quickly, we recommend conducting these searches frequently: if they can be automated to the organization's satisfaction, perhaps once a day (see also [Guidance on Communicating Results](../../howto/bootstrap/use.md)). +An analyst should feel comfortable selecting *none* if they (or their search scripts) have performed searches in the appropriate places for public *PoC*s and *active* exploitation (as described above) and found *none*. + + +## CWE with PoC examples list +{% include-markdown "../../_includes/cwe-with-poc-examples.md" heading-offset=1 %} diff --git a/docs/howto/gathering_info/index.md b/docs/howto/gathering_info/index.md new file mode 100644 index 00000000..2556e51d --- /dev/null +++ b/docs/howto/gathering_info/index.md @@ -0,0 +1,12 @@ +# Gathering Information + +We offer additional guidance on how to gather information about some decision points so that you can determine the corresponding decision values. + +
+- :fontawesome-solid-gears: [Automatable](automatable.md) +- :octicons-shield-x-16: [Exploitation](exploitation.md) +- :material-state-machine: [Mission Impact](mission_impact.md) +- :material-access-point-network: [System Exposure](system_exposure.md) +- :octicons-goal-16: [Technical Impact](technical_impact.md) +- :material-city-variant-outline: [Value Density](value_density.md) +
\ No newline at end of file diff --git a/docs/howto/gathering_info/mission_impact.md b/docs/howto/gathering_info/mission_impact.md new file mode 100644 index 00000000..13936a51 --- /dev/null +++ b/docs/howto/gathering_info/mission_impact.md @@ -0,0 +1,14 @@ +# Gathering Information About Mission Impact + +```python exec="true" idprefix="" +from ssvc.decision_points.ssvc.mission_impact import LATEST +from ssvc.doc_helpers import example_block + +print(example_block(LATEST)) +``` + +The factors that influence the mission impact level are diverse. +At a minimum, understanding mission impact should include gathering information about the critical paths that involve vulnerable components, viability of contingency measures, and resiliency of the systems that support the mission. +There are various sources of guidance on how to gather this information; see for example the FEMA guidance in [Continuity Directive 2](https://www.fema.gov/sites/default/files/2020-07/Federal_Continuity_Directive-2_June132017.pdf) or [OCTAVE FORTE](https://insights.sei.cmu.edu/insider-threat/2018/06/octave-forte-and-fair-connect-cyber-risk-practitioners-with-the-boardroom.html). +This is part of risk management more broadly. +It should require the vulnerability management team to interact with more senior management to understand mission priorities and other aspects of risk mitigation. diff --git a/docs/howto/gathering_info/system_exposure.md b/docs/howto/gathering_info/system_exposure.md new file mode 100644 index 00000000..baf7a76c --- /dev/null +++ b/docs/howto/gathering_info/system_exposure.md @@ -0,0 +1,33 @@ +# Gathering Information About System Exposure + +```python exec="true" idprefix="" +from ssvc.decision_points.ssvc.system_exposure import LATEST +from ssvc.doc_helpers import example_block + +print(example_block(LATEST)) +``` + +*System Exposure* is primarily used by [Deployers](../../deployer_tree), so the question is about whether some specific system is in fact exposed, not a hypothetical or aggregate question about systems of that type. +Therefore, it generally has a concrete answer, even though it may vary from vulnerable component to vulnerable component, based on their respective configurations. + +*System Exposure* can be readily informed by network scanning techniques. +For example, if the vulnerable component is visible on [Shodan](https://www.shodan.io) or by some other external scanning service, then it is *open*. +Network policy or diagrams are also useful information sources, especially for services intentionally open to the Internet such as public web servers. +An analyst should also choose *open* for a phone or PC that connects to the web or email without the usual protections (IP and URL blocking, updated firewalls, etc.). + +## *Small* versus *Controlled* System Exposure + +Distinguishing between *small* and *controlled* is more nuanced. +If *open* has been ruled out, some suggested heuristics for differentiating the other two are as follows. +Apply these heuristics in order and stop when one of them applies. + +- If the system's networking and communication interfaces have been physically removed or disabled, choose *small*. +- If [*Automatable*](automatable.md) is [*yes*](automatable.md), then choose *controlled*. The reasoning behind this heuristic is that if reconnaissance through exploitation is automatable, then the usual deployment scenario exposes the system sufficiently that access can be automated, which contradicts the expectations of *small*. +- If the vulnerable component is on a network where other hosts can browse the web or receive email, choose *controlled*. +- If the vulnerable component is in a third party library that is unreachable because the feature is unused in the surrounding product, choose *small*. + +The unreachable vulnerable component scenario may be a point of concern for stakeholders like [patch suppliers](../../howto/supplier_tree.md) who often find it more cost-effective to simply update the included library to an existing fixed version rather than try to explain to customers why the vulnerable code is unreachable in their own product. +In those cases, we suggest the stakeholder reviews the decision outcomes of the tree to ensure the appropriate action is taken (paying attention to [*defer*](../../howto/supplier_tree.md) vs [*scheduled*](../../howto/supplier_tree.md), for example). + + +{% include-markdown "../../_includes/question_callout.md" heading-offset=1 %} diff --git a/docs/howto/gathering_info/technical_impact.md b/docs/howto/gathering_info/technical_impact.md new file mode 100644 index 00000000..f7ff498b --- /dev/null +++ b/docs/howto/gathering_info/technical_impact.md @@ -0,0 +1,22 @@ +# Gathering Information About Technical Impact + +```python exec="true" idprefix="" +from ssvc.decision_points.ssvc.technical_impact import LATEST +from ssvc.doc_helpers import example_block + +print(example_block(LATEST)) +``` + +Assessing *Technical Impact* amounts to assessing the degree of control over the vulnerable component the attacker stands to gain by exploiting the vulnerability. +One way to approach this analysis is to ask whether the control gained is *total* or not. +If it is not total, it is *partial*. +If an answer to one of the following questions is *yes*, then control is *total*. +After exploiting the vulnerability, + +- can the attacker install and run arbitrary software? +- can the attacker trigger all the actions that the vulnerable component can perform? +- does the attacker get an account with full privileges to the vulnerable component (administrator or root user accounts, for example)? + +This list is an evolving set of heuristics. + +{% include-markdown "../../_includes/question_callout.md" heading-offset=1 %} diff --git a/docs/howto/gathering_info/value_density.md b/docs/howto/gathering_info/value_density.md new file mode 100644 index 00000000..dabc20ad --- /dev/null +++ b/docs/howto/gathering_info/value_density.md @@ -0,0 +1,23 @@ +# Gathering Information About Value Density + +```python exec="true" idprefix="" +from ssvc.decision_points.ssvc.value_density import LATEST +from ssvc.doc_helpers import example_block + +print(example_block(LATEST)) +``` + +The heuristics presented in the *Value Density* definitions involve whether the system is usually maintained by a dedicated professional, although we have noted some exceptions (such as encrypted mobile messaging applications). + +{% include-markdown "../../_includes/question_callout.md" heading-offset=1 %} + +An analyst might use market research reports or Internet telemetry data to assess an unfamiliar product. +Organizations such as Gartner produce research on the market position and product comparisons for a large variety of systems. +These generally identify how a product is deployed, used, and maintained. +An organization's own marketing materials are a less reliable indicator of how a product is used, or at least how the organization expects it to be used. + +Network telemetry can inform how many instances of a software system are connected to a network. +Such telemetry is most reliable for the supplier of the software, especially if software licenses are purchased and checked. +Measuring how many instances of a system are in operation is useful, but having more instances does not mean that the software is a densely valuable target. +However, market penetration greater than approximately 75% generally means that the product uniquely serves a particular market segment or purpose. +This line of reasoning is what supports a determination that an ubiquitous encrypted mobile messaging application should be considered to have a *concentrated* Value Density. diff --git a/docs/howto/index.md b/docs/howto/index.md index 17946887..5e974b34 100644 --- a/docs/howto/index.md +++ b/docs/howto/index.md @@ -7,7 +7,7 @@ - An interest in using SSVC in a vulnerability management process - Basic familiarity with SSVC - If you are unfamiliar with SSVC, we suggest you start with the [Learning SSVC](../tutorials/index.md) section. + If you are unfamiliar with SSVC, we suggest you start with the [SSVC Overview](../tutorials/ssvc_overview.md) section. [Understanding SSVC](../topics/index.md) provides necessary background detail. For technical reference, see [Reference](../reference/index.md). diff --git a/docs/howto/publication_decision.md b/docs/howto/publication_decision.md index 1673302a..d0c396be 100644 --- a/docs/howto/publication_decision.md +++ b/docs/howto/publication_decision.md @@ -11,7 +11,7 @@ While other stakeholders may also have to make a publication decision, here we f the combination of the stakeholder and the decision being modeled. In this case, the stakeholder is the **Coordinator** and the decision is **whether to publish an advisory about the vulnerability**. -## Policy Constraints and Publication Decisions +## Decision Table Constraints and Publication Decisions !!! tip inline end "Other Stakeholders' Publication Decisions" @@ -88,12 +88,13 @@ based on some other criteria. For the CERT/CC, the publication decision is binary: publish or do not publish. -!!! note "Coordinator Publish Priority" +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.coord_pub_dt import LATEST as DT +from ssvc.doc_helpers import example_block - | Publish Priority | Description | - | :--- | :---------- | - | Do not publish | Do not publish information about the vulnerability. | - | Publish | Publish information about the vulnerability. | +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` !!! tip "The Publication Decision is Time Sensitive" @@ -133,140 +134,37 @@ and adds two new ones ([*Supplier Involvement*](../reference/decision_points/sup More detail about each of these decision points is provided at the links above, here we provide a brief summary of each. ```python exec="true" idprefix="" -from ssvc.decision_points.supplier_involvement import LATEST as SI -from ssvc.decision_points.exploitation import LATEST as EXP -from ssvc.decision_points.public_value_added import LATEST as PVA - +from ssvc.decision_tables.ssvc.coord_pub_dt import LATEST as DT from ssvc.doc_helpers import example_block -for dp in [SI, EXP, PVA]: +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: print(example_block(dp)) + ``` ## Coordinator Publication Decision Model -An example coordinator publication decision model is shown below. The policy described by the model is based on CERT/CC +An example coordinator publication decision model is shown below. The decision table described by the model is based on CERT/CC publication decisions. Other organizations may have different publication criteria and may want to include other decision points in their publication decision model. - - - - -|fix ready| e1 - si -->|cooperative| e2 - si -->|uncooperative/
unresponsive| e3 - va1[Value
Added] - va2[Value
Added] - va3[Value
Added] - e1 -->|none| va1 - e1 -->|PoC| va2 - e1 -->|active| va3 - va4[Value
Added] - va5[Value
Added] - va6[Value
Added] - e2 -->|none| va4 - e2 -->|PoC| va5 - e2 -->|active| va6 - va7[Value
Added] - va8[Value
Added] - va9[Value
Added] - e3 -->|none| va7 - e3 -->|PoC| va8 - e3 -->|active| va9 - - p1[Publish] - p2[Don't Publish] - p3[Don't Publish] - - p4[Publish] - p5[Don't Publish] - p6[Don't Publish] - - p7[Publish] - p8[Publish] - p9[Don't Publish] - - p10[Publish] - p11[Don't Publish] - p12[Don't Publish] - - p13[Publish] - p14[Don't Publish] - p15[Don't Publish] - - p16[Publish] - p17[Publish] - p18[Don't Publish] - - p19[Publish] - p20[Don't Publish] - p21[Don't Publish] - - p22[Publish] - p23[Publish] - p24[Don't Publish] - - p25[Publish] - p26[Publish] - p27[Don't Publish] - - va1 -->|precedence| p1 - va1 -->|ampliative| p2 - va1 -->|limited| p3 - - va2 -->|precedence| p4 - va2 -->|ampliative| p5 - va2 -->|limited| p6 - - va3 -->|precedence| p7 - va3 -->|ampliative| p8 - va3 -->|limited| p9 - - va4 -->|precedence| p10 - va4 -->|ampliative| p11 - va4 -->|limited| p12 - - va5 -->|precedence| p13 - va5 -->|ampliative| p14 - va5 -->|limited| p15 - - va6 -->|precedence| p16 - va6 -->|ampliative| p17 - va6 -->|limited| p18 - - va7 -->|precedence| p19 - va7 -->|ampliative| p20 - va7 -->|limited| p21 - - va8 -->|precedence| p22 - va8 -->|ampliative| p23 - va8 -->|limited| p24 - - va9 -->|precedence| p25 - va9 -->|ampliative| p26 - va9 -->|limited| p27 +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.coord_pub_dt import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) ``` ---> ### Table of Values - -{{ read_csv('coord-publish-options.csv') }} +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.coord_pub_dt import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/supplier_tree.md b/docs/howto/supplier_tree.md index e714e907..4b785d56 100644 --- a/docs/howto/supplier_tree.md +++ b/docs/howto/supplier_tree.md @@ -51,14 +51,22 @@ The organization considers several other factors to build the patch; refactoring be necessary for some patches, while others require relatively small changes. We focus only on the priority of building the patch, and we consider four categories of priority, as outlined in the table below. -!!! note "Patch Supplier Priority" +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.supplier_dt import LATEST as DT +from ssvc.doc_helpers import example_block + +dp = DT.decision_points[DT.outcome] +print(example_block(dp)) +``` - | Supplier Priority | Description | - | :--- | :---------- | - | Defer | Do not work on the patch at present. | - | Scheduled | Develop a fix within regularly scheduled maintenance using supplier resources as normal. | - | Out-of-Cycle | Develop mitigation or remediation out-of-cycle, taking resources away from other projects and releasing the fix as a security patch when it is ready. | - | Immediate | Develop and release a fix as quickly as possible, drawing on all available resources, potentially including drawing on or coordinating resources from other parts of the organization. | +A more specific interpretation for the priority levels for suppliers is as follows: + +| Supplier Priority | Description | +| :--- | :---------- | +| Defer | Do not work on the patch at present. | +| Scheduled | Develop a fix within regularly scheduled maintenance using supplier resources as normal. | +| Out-of-Cycle | Develop mitigation or remediation out-of-cycle, taking resources away from other projects and releasing the fix as a security patch when it is ready. | +| Immediate | Develop and release a fix as quickly as possible, drawing on all available resources, potentially including drawing on or coordinating resources from other parts of the organization. | ## Supplier Decision Points @@ -72,14 +80,10 @@ The decision to create a patch is based on the following decision points: More detail about each of these decision points is provided at the links above, here we provide a brief summary of each. ```python exec="true" idprefix="" -from ssvc.decision_points.exploitation import LATEST as EXP -from ssvc.decision_points.utility import LATEST as U -from ssvc.decision_points.technical_impact import LATEST as TI -from ssvc.decision_points.public_safety_impact import LATEST as PSI - +from ssvc.decision_tables.ssvc.supplier_dt import LATEST as DT from ssvc.doc_helpers import example_block -for dp in [EXP, U, TI, PSI]: +for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: print(example_block(dp)) ``` @@ -90,17 +94,30 @@ for dp in [EXP, U, TI, PSI]: ## Supplier Decision Model -The example supplier decision model below shows a prioritization policy for the supplier. -We display the decision model as a decision tree, which provides a compact representation of the policy, +The example supplier decision model below shows a prioritization decision table for the supplier. +We display the decision model as a decision tree, which provides a compact representation of the decision table, showing the relative priority of different situations. -{% include-markdown "../_includes/_tree_notation_tip.md" %} +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.supplier_dt import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt - +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` ### Table of Values - -{{ read_csv('supplier-options.csv') }} +The table below shows the values for the decision model. +Each row of the table corresponds to a path through the decision model diagram above. + +{% include-markdown "../_includes/_scrollable_table.md" heading-offset=1 %} + +```python exec="true" idprefix="" + +from ssvc.decision_tables.ssvc.supplier_dt import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` diff --git a/docs/howto/tools/containers.md b/docs/howto/tools/containers.md new file mode 100644 index 00000000..fff6e750 --- /dev/null +++ b/docs/howto/tools/containers.md @@ -0,0 +1,52 @@ +# SSVC Docker Containers + +## Prerequisites + +Before you begin, ensure you have the following installed: + +- Docker +- Docker Compose + +Then clone the repository: + +```shell +git clone https://github.com/CERTCC/SSVC.git +cd SSVC +``` + +!!! tip "Quick Start" + + To quickly start all the containers, run: + + ```shell + docker-compose --project-directory=docker up + ``` + +## Test + +We provide a containerized environment to run the SSVC test suite. + +```shell +docker-compose --project-directory=docker up test +``` + +## Docs + +We provide a containerized environment to build and serve the SSVC documentation (this website). + +```shell +docker-compose --project-directory=docker up docs +``` + +Then browse to `http://localhost:8000/docs` to access the docs site. + +## SSVC Object Registry API Container + +We provide containerized FastAPI server that allows you to run a local instance +of the SSVC Object Registry API. + +```shell +docker-compose --project-directory=docker up api +``` + +Then browse to `http://localhost:8001/docs` to access the API documentation. diff --git a/docs/howto/using_epss/epss_percentiles.md b/docs/howto/using_epss/epss_percentiles.md new file mode 100644 index 00000000..c528921c --- /dev/null +++ b/docs/howto/using_epss/epss_percentiles.md @@ -0,0 +1,171 @@ +# EPSS Quantile Binning as an SSVC Amplifier + +!!! tip inline end "" + + !!! tip "Obtain SSVC Data" + + If you are using the [SSVC Deployer Decision Model](../deployer_tree.md), you might already know that + the [CISA Vulnrichment program](https://github.com/cisagov/vulnrichment) + provides some SSVC data that is made + available via the [CVE Services API](https://cveawg.mitre.org/api-docs/). + + !!! tip "Obtain EPSS Data" + + You can get EPSS data from the [EPSS website](https://www.first.org/epss/) + or use their [API](https://www.first.org/epss/api) to fetch scores programmatically. + +In [another how-to](epss_probability.md), we showed how to use the [Exploit Prediction Scoring System](https://www.first.org/epss/) +([EPSS](https://www.first.org/epss)) +probability scores as one of a few different inputs to inform the +SSVC [Exploitation](../../reference/decision_points/exploitation.md) decision point. +This approach can be a useful approach to refine or augment the *input* to an existing SSVC decision model. + +!!! question "What's in this How-To?" + + In this how-to, we'll explore a different approach that uses EPSS percentiles + as an amplifier to adjust the *output* of an existing SSVC decision model. + +## Starting Out with the SSVC Deployer Decision Model + +Let's start with the assumption that you're already using the +[SSVC Deployer Decision Model](../deployer_tree.md) and have a basic understanding of SSVC. +But then after reading +[Probability, Percentiles, and Binning - How to understand and interpret EPSS Scores](https://www.first.org/epss/articles/prob_percentile_bins), +you realize that you would like to use EPSS percentiles to amplify the output of your existing decision model. + +!!! question "Why use percentiles instead of raw probabilities?" + + Percentiles provide a relative ranking of vulnerabilities based on their EPSS scores. + This can be particularly useful when you want to prioritize vulnerabilities in the context of the entire vulnerability landscape. + By using percentiles, you can identify which vulnerabilities are more likely to be exploited _compared to others_. + The [EPSS SIG blog](https://www.first.org/epss/articles/prob_percentile_bins) discusses some of the tradeoffs involved in using percentiles versus raw probabilities. + + That said, we are using percentiles for this how-to simply because we already + we showed how to use probabilities in [another how-to](epss_probability.md). + Either approach can be valid depending on your specific needs and context. + +One straightforward way to use EPSS is to create bins based on the EPSS score +and use these bins as amplifiers in your SSVC decision-making process. + +!!! tip "See Also" + + See the sidebar in [this how-to](epss_probability.md) for a discussion of the tradeoffs involved in binning. + +## Binning Percentiles + +SSVC provides several basic decision points that bin percentiles into discrete quantiles. +Expand the example below to see the currently available options. + +??? example "Exploring Decision Points for Binning Percentiles" + + ```python exec="true" idprefix="" + from ssvc.doc_helpers import example_block + from ssvc.decision_points.basic.quantiles import DECISION_POINTS as _DPS + + for dp in _DPS.values(): + print(example_block(dp)) + ``` + +Now, your primary concern is to ensure that you are addressing the +vulnerabilities that are most likely to be exploited. +In conversations with your organization's risk owners, you determine that +they'd like to apply a policy that is consistent with the following: + +- If the EPSS percentile is significantly higher than the median, the vulnerability + should be prioritized two levels higher than the default SSVC recommendation. +- If the EPSS percentile is above the median but not significantly so, the vulnerability + should be prioritized one level higher than the default SSVC recommendation. +- If the EPSS percentile is significantly lower than the median, the vulnerability + should be deprioritized lower than the default SSVC recommendation. + +You can achieve this with the `quartiles` decision point: + +```python exec="true" idprefix="" +from ssvc.decision_points.basic.quantiles.quartiles import LATEST as QUARTILES +from ssvc.doc_helpers import example_block + +print(example_block(QUARTILES)) +``` + +!!! warning inline end "We're not saying this is a good rule set!" + + The rules given here are just an example to illustrate how you might use EPSS percentiles + as an amplifier in your decision-making process. + We are not suggesting that this is a good idea or that you should follow these rules. + In fact, these rules are rather aggressive and could result in fully _half_ of all + vulnerabilities being prioritized _higher_ than they would without the EPSS data. + Your organization's risk owners should determine the appropriate policy for your context, + but we would recommend something considerably less aggressive than this example. + +You decide to apply the following rules: + +```python exec="true" idprefix="" +from ssvc.decision_tables.example.epss_quartile import update_map_doc + +print(update_map_doc()) +``` + +## Building the Decision Table + +Given the rules outlined above, you build a new Decision Table that takes the +default outcome from the +[SSVC Deployer Decision Model](../deployer_tree.md) and applies the EPSS quartile +information to amplify it. The resulting decision table looks like this: + +```python exec="true" idprefix="" +from ssvc.decision_tables.example.epss_quartile import EXAMPLE as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` + +A diagram of the decision model is shown below. + +???+ example "Example Decision Table Diagram" + + ```python exec="true" idprefix="" + from ssvc.decision_tables.example.epss_quartile import EXAMPLE as DT + from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + + rows = DT.mapping + title = mermaid_title_from_dt(DT) + print(mapping2mermaid(rows, title=title)) + ``` + +And here is a JSON object representation of the decision table for programmatic use: + +??? example "Example Decision Table JSON" + + The JSON representation of the decision table is shown below. + + ```python exec="true" idprefix="" + from ssvc.decision_tables.example.epss_quartile import EXAMPLE as DT + + print("```json") + print(DT.model_dump_json(indent=2)) + print("```") + ``` + +Now you can use this decision table in your SSVC implementation to adjust +the prioritization of vulnerabilities based on their EPSS percentiles. + +!!! question "How can I sort work items within a given SSVC outcome category?" + + While we don't usually recommend sorting within a given SSVC outcome category, + we recognize that some organizations may want to do this. + + If you want to sort vulnerabilities within a given SSVC outcome (e.g., all vulnerabilities + that are classified as "Immediate"), you can use the raw EPSS probability score + as a secondary sorting key. + This way, even if multiple vulnerabilities fall into the same SSVC category, + you can still prioritize them based on their predicted likelihood of exploitation. + +## Conclusion + +In this how-to, we've demonstrated how to use EPSS percentiles as an amplifier +to adjust the output of an existing SSVC decision model. +While the example provided is considerably more aggressive than we would recommend +in practice, it illustrates one way to incorporate EPSS data into an established SSVC-based +vulnerability management strategy. +By incorporating statistical insights from EPSS, you can prioritize +vulnerabilities more effectively based on their likelihood of exploitation. diff --git a/docs/howto/using_epss/epss_probability.md b/docs/howto/using_epss/epss_probability.md new file mode 100644 index 00000000..c14c1630 --- /dev/null +++ b/docs/howto/using_epss/epss_probability.md @@ -0,0 +1,179 @@ +# Combining EPSS with other Exploitation-Related Decision Points + +SSVC users might want to combine exploitation-related information from multiple +sources into a single decision point for use downstream in a decision table +such as the SSVC [Deployer Decision Model](../deployer_tree.md). + +!!! question "What's in this How-To?" + + This How-To explores how to combine information from multiple sources + via SSVC Decision Points and Decision Tables to create a more nuanced view + of exploitation risk. + +One such source is the [Exploit Prediction Scoring System](https://www.first.org/epss/) +([EPSS](https://www.first.org/epss)) probability score. + +!!! question "What is the EPSS Probability Score?" + + The EPSS probability score is a number between 0 and 1 that indicates the likelihood of + a vulnerability being exploited in the wild within the next 30 days. + +## Other Exploitation-Related Information Sources + +However, EPSS is not the only source of exploitation-related information. +The +[CISA Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) +is another important source. +Additional exploitation-related information can be found in the +[CVSS Exploit Maturity](https://www.first.org/cvss/specification-document#Exploit-Maturity-E) +vector element. + +We have implemented SSVC Decision Points to reflect both CISA KEV and CVSS Exploit Maturity: + +```python exec="true" idprefix="" +from ssvc.doc_helpers import example_block +from ssvc.decision_points.cvss.exploit_maturity import LATEST as CVSS_E +from ssvc.decision_points.cisa.in_kev import LATEST as CISA_KEV + +for dp in [CISA_KEV, CVSS_E]: + print(example_block(dp)) +``` + +!!! note inline end "EPSS on Probability Binning" + + In a [blog post](https://www.first.org/epss/articles/prob_percentile_bins) on the + [EPSS website](https://www.first.org/epss), the EPSS SIG discusses the challenges of + binning probabilities. + + !!! quote "EPSS SIG on Binning" + + However, there are a number of problems with binning. Bins are, by construction, subjective transformations of, in this case, a cardinal probability scale. And because the bins are subjectively defined, there is room for disagreement and misalignment across different users. There is no universal "right" answer to what the cut off should be between a high, and medium, or medium and low. + + Moreover, arbitrary cutoffs force two scores, which may be separated by the tiniest of a value, to be labeled and then handled differently, despite there being no practical difference between them. For example, if two bins are set and the cutoff is set at 0.5, two vulnerabilities with probabilities of 0.499 and 0.501 would be treated just the same as two vulnerabilities with probabilities of 0.001 and 0.999. This kind of range compression is unavoidable and so any benefits from this kind of mental shortcut must be weighed against the information loss inevitable with binning. + + For these reasons, EPSS does not currently bin EPSS scores using labels. + + From a data _provider_ perspective, this makes sense. + Avoiding information loss early in the information pipeline is a good idea. + However, from a data _consumer_ perspective, and especially when one is making + a choice between a finite number of options (as in SSVC), binning can be a useful + tool to reduce the complexity of the decision space. + +## Binning Probabilities + +We have also provided a few basic SSVC Decision Points to capture probability-based +information in different ways. +Because SSVC is based on categorical decision points, we need to bin the +continuous probability scores into discrete categories. +However, as the EPSS SIG points out (see sidebar), there are *always* tradeoffs +involved in binning. +That's why we provide several different options for binning probabilities so that +SSVC users can choose one that best fits their needs (or create their own if +none of the provided options is suitable). +Expand the example below to see the currently available options. + +??? example "Exploring Decision Points for Binning Probabilities" + + We provide a few different decision points based on probability bins. + You might look these over and choose one that fits your needs. + + ```python exec="true" idprefix="" + from ssvc.doc_helpers import example_block + from ssvc.decision_points.basic.probability import DECISION_POINTS as _DPS + + for dp in _DPS.values(): + print(example_block(dp)) + ``` + +For this example, let's say you decide to use the *Probability Scale in 5 weighted levels, ascending* +decision point: + +```python exec="true" idprefix="" +from ssvc.doc_helpers import example_block +from ssvc.decision_points.basic.probability.five_weighted import LATEST as DP + +print(example_block(DP)) +``` + +With our exploitation and probability binning decision points in hand, +we can now consider how to combine them in a decision table to get +a more nuanced view of exploitation risk. + +## Designing an Exploitation-focused Decision Table + +Let's say you decide to create a new Decision Table that combines the +EPSS probability information with the other exploitation-related decision +points to determine a more informed outcome using the SSVC [Exploitation](../../reference/decision_points/exploitation.md) decision point. + +As a reminder, the SSVC [Exploitation](../../reference/decision_points/exploitation.md) decision point has the following values: + +```python exec="true" idprefix="" +from ssvc.doc_helpers import example_block +from ssvc.decision_points.ssvc.exploitation import LATEST as EXP + +for dp in [EXP]: + print(example_block(dp)) +``` + +In conversations with your organization's risk owners, you determine that you +should focus your vulnerability management efforts on the vulnerabilities +that are either already being actively exploited or are very likely to be exploited soon. + +You decide to apply the following rules: + +| Rule | Description | +|------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Prioritize vuls in KEV as Active | If the vulnerability is in the CISA KEV, set the SSVC [Exploitation](../../reference/decision_points/exploitation.md) value to *Active*. | +| Treat very high EPSS probabilities as already Active | If the EPSS probability is >90%, set SSVC [Exploitation](../../reference/decision_points/exploitation.md) value to *Active*. | +| Amplify high EPSS probabilities | If the EPSS probability is 75-90%, bump the SSVC [Exploitation](../../reference/decision_points/exploitation.md) value up one category across the board. | +| Assume Public PoCs are Active when EPSS probability is more likely than not. | If the EPSS probability is 55-75%, bump SSVC [Exploitation](../../reference/decision_points/exploitation.md) = *Public PoC* to *Active* | +| Default: Use CVSS Exploit Maturity | By default, use the [CVSS Exploit Maturity](../../reference/decision_points/cvss/exploit_maturity.md) value to set the SSVC [Exploitation](../../reference/decision_points/exploitation.md) value, unless one of the other rules apply. | + +After constructing the decision table according to these rules, you end up with the following table of values: + +```python exec="true" idprefix="" +from ssvc.decision_tables.example.epss_percentile import EXAMPLE as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` + +A diagram of the decision model is shown below. + +???+ example "Example Decision Table Diagram" + + The diagram below shows the decision model for this example. + Each path through the diagram corresponds to a row in the table above. + + ```python exec="true" idprefix="" + from ssvc.decision_tables.example.epss_percentile import EXAMPLE as DT + from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + + rows = DT.mapping + title = mermaid_title_from_dt(DT) + print(mapping2mermaid(rows, title=title)) + ``` + +And here is a JSON object representation of the decision table for programmatic use: + +??? example "Example Decision Table JSON" + + The JSON representation of the decision table is shown below. + + ```python exec="true" idprefix="" + from ssvc.decision_tables.example.epss_percentile import EXAMPLE as DT + print("```json") + print(DT.model_dump_json(indent=2)) + print("```") + ``` + +Now you've created a clear way to combine EPSS probability scores with other +exploitation-related information to inform your SSVC decisions downstream. + +## Conclusion + +In this How-To, we've explored how to combine EPSS probability scores with other +exploitation-related information in an SSVC decision table. +By thoughtfully designing decision points and tables, you can create a more nuanced +and effective vulnerability management strategy that prioritizes risks based on +the likelihood of exploitation. diff --git a/docs/howto/using_epss/index.md b/docs/howto/using_epss/index.md new file mode 100644 index 00000000..dff9ef57 --- /dev/null +++ b/docs/howto/using_epss/index.md @@ -0,0 +1,29 @@ +# EPSS → SSVC Intro + +!!! quote inline end "The [FIRST EPSS SIG](https://www.first.org/epss) Explains [EPSS](https://www.first.org/epss/model)" + + EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days + +The [Exploit Prediction Scoring System](https://www.first.org/epss) ([EPSS](https://www.first.org/epss)) is a statistical model that estimates the likelihood of a vulnerability being exploited in the wild. EPSS can be a valuable input when assessing the exploitation risk associated with vulnerabilities. EPSS provides two key metrics: + +- **EPSS Score**: A score between 0 and 1 indicating the probability of exploitation. +- **EPSS Percentile**: A ranking percentile that indicates how the EPSS score compares to other vulnerabilities. + +In the following pages, we'll demonstrate a few different ways to incorporate EPSS data into your SSVC decision models. + +
+ +- :material-dice-multiple: [Using EPSS Probability Scores as an Input to SSVC Decisions](epss_probability.md) + + --- + + How to use EPSS probability scores to augment other data sources to + inform the SSVC Exploitation decision point. + +- :material-percent: [Using EPSS Percentiles to Amplify SSVC Decisions](epss_percentiles.md) + + --- + + How to use EPSS percentiles to amplify the output of an existing SSVC decision model. + +
diff --git a/docs/index.md b/docs/index.md index c5f03313..496a1125 100644 --- a/docs/index.md +++ b/docs/index.md @@ -10,16 +10,16 @@ We have organized the SSVC documentation into four main sections:
-- :fontawesome-regular-eye:{ .lg .middle } **SSVC Overview** +- :fontawesome-regular-eye:{ .lg .middle } [**SSVC Overview**](tutorials/ssvc_overview.md) --- A beginner's guide to SSVC. This section is for people who have never heard of SSVC. - [:octicons-arrow-right-24: An Overview of SSVC](ssvc_overview.md) + [:octicons-arrow-right-24: An Overview of SSVC](tutorials/ssvc_overview.md) -- :material-clipboard-check:{ .lg .middle } **SSVC How To** +- :material-clipboard-check:{ .lg .middle } [**SSVC How To**](howto/index.md) --- @@ -28,7 +28,7 @@ We have organized the SSVC documentation into four main sections: [:octicons-arrow-right-24: SSVC How To](howto/index.md) -- :fontawesome-solid-book:{ .lg .middle } **More about SSVC** +- :fontawesome-solid-book:{ .lg .middle } [**More about SSVC**](topics/index.md) --- @@ -37,7 +37,7 @@ We have organized the SSVC documentation into four main sections: [:octicons-arrow-right-24: Understanding SSVC](topics/index.md) -- :material-book-open-page-variant:{ .lg .middle } **SSVC Reference** +- :material-book-open-page-variant:{ .lg .middle } [**SSVC Reference**](reference/index.md) --- diff --git a/docs/reference/code/decision_point_groups.md b/docs/reference/code/decision_point_groups.md new file mode 100644 index 00000000..3152a200 --- /dev/null +++ b/docs/reference/code/decision_point_groups.md @@ -0,0 +1,20 @@ +# Decision Point Groups + +Decision Point groups provide collections of related Decision Points for some +specific purpose. + +With the introduction of [Decision Tables](decision_tables.md), +Decision Point groups are less important than they once were, and may be +removed in a future release. +However, they can still be useful for documentation and +for some programmatic uses. + +::: ssvc.dp_groups.base + +## SSVC Decision Point Groups + +::: ssvc.dp_groups.ssvc.collections + +## CVSS Decision Point Groups + +::: ssvc.dp_groups.cvss.collections diff --git a/docs/reference/code/decision_points.md b/docs/reference/code/decision_points.md new file mode 100644 index 00000000..6e23fe5a --- /dev/null +++ b/docs/reference/code/decision_points.md @@ -0,0 +1,7 @@ +# Decision Point Objects + +::: ssvc.decision_points + +::: ssvc.decision_points.base + +::: ssvc.decision_points.helpers diff --git a/docs/reference/code/decision_tables.md b/docs/reference/code/decision_tables.md new file mode 100644 index 00000000..a7b280b5 --- /dev/null +++ b/docs/reference/code/decision_tables.md @@ -0,0 +1,7 @@ +# Decision Tables + +::: ssvc.decision_tables + +::: ssvc.decision_tables.base + +::: ssvc.decision_tables.helpers diff --git a/docs/reference/code/index.md b/docs/reference/code/index.md index 0d36bea8..1485b64d 100644 --- a/docs/reference/code/index.md +++ b/docs/reference/code/index.md @@ -1,10 +1,15 @@ # SSVC Code Documentation This section provides documentation for the SSVC Python modules. + These include: +- [Decision Points](decision_points.md) +- [Decision Tables](decision_tables.md) +- [Decision Point Groups](decision_point_groups.md) (Deprecated) +- [Namespaces](namespaces.md) +- [Selections](selection.md) - [CSV Analyzer](analyze_csv.md) - [Policy Generator](policy_generator.md) -- [Outcomes](outcomes.md) - [Namespaces](namespaces.md) - [Doctools](doctools.md) diff --git a/docs/reference/code/namespaces.md b/docs/reference/code/namespaces.md index bc7ed7b4..01ac1d45 100644 --- a/docs/reference/code/namespaces.md +++ b/docs/reference/code/namespaces.md @@ -1,3 +1,432 @@ # SSVC Namespaces +We use namespaces in SSVC to organize the various components of the framework. +The bulk of our work is done in the `ssvc` namespace, which contains the core +decision points for SSVC. + +!!! question "Why does SSVC need namespaces?" + + We want to provide a clear way to differentiate between decision points we + developed as part of the SSVC project, and those that are derived from work + done by other projects. This helps us maintain clarity in our codebase and + to avoid confusion when integrating with other systems or libraries. + +## Namespace Structure + +Namespaces are structured as follows: + +```mermaid +--- +title: SSVC Namespace Structure +--- +flowchart LR + base_ns[Base Namespace] + exts[Extensions] + base_ns -->|/| exts +``` + +A namespace consists of a base namespace and optional extensions. + +### Base Namespace + +The base namespace can be either registered or unregistered. +The following diagram illustrates the structure of the base namespace: + +```mermaid +--- +title: Base Namespace Structure +--- +flowchart LR + +subgraph base_ns[Base Namespace] + direction TB + subgraph unregistered[Unregistered Namespace] + direction LR + xpfx[x_] + reverse_ns[Reverse Domain Name Notation] + fragment[Fragment] + xpfx --> reverse_ns --> fragment + end + subgraph registered[Registered Namespace] + direction LR + base_registered[Registered Base Namespace] + base_fragment[Fragment] + base_registered -.->|optional| base_fragment + end + registered ~~~|OR| unregistered +end +``` + +!!! warning "Reserved Namespace Strings" + + The SSVC project has _reserved_ the following namespace strings: + + - `example` and `x_example`are _reserved_ for use in documentation or as + examples where a registered or unregistered namespace is needed, respectively. + No production use of the `example` or `x_example` namespace is intended. + + - `test` and `x_test` are _reserved_ for use in testing of current + or new SSVC related code. + No production use of the `test` namespace is intended. + + - `invalid` and `x_invalid` are _reserved_ and must not be used as + registered or unregistered namespaces, respectively. Attempting to create an + object using either of these strings will result in an error in the Python + implementation of SSVC. + +!!! info inline end "Current Registered Namespaces" + + The SSVC project currently has a set of registered namespaces that are + intended to be used as part of the framework. These namespaces are defined + in the `ssvc.namespaces` module and can be accessed via the `NameSpace` enum. + Current registered namespaces are: + + ```python exec="true" idprefix="" + from ssvc.namespaces import NameSpace + + for ns in NameSpace: + print(f"- {ns.value}") + ``` + +#### Registered Namespace + +Registered namespaces are those that are explicitly defined in the SSVC project. +A list of the current registered namespaces can be found in the sidebar. + +Registered namespaces are intended to be used as follows: + +- Objects in the `ssvc` namespace are managed by the SSVC + project team. We have complete control over these ones. +- Objects in other explicitly registered namespaces are provided for convenience, + but the SSVC team is not responsible for modifying the content or semantics of + those decision points. +- The registered namespaces `example` and `test` can be used in documentation or + as examples, where registered namespaces are necessary. + +!!! note "Registered Non-`ssvc` Namespaces" + + We use namespaces other than `ssvc` to indicate decision points that are based + externally defined standards, specifications, or relevant projects. + We expect for decision points in these namespaces to be technically compatible + with SSVC, but we do not claim any ownership or responsibility for the + underlying specifications or their semantic content. + Objects in these namespaces are provided for the convenience + of SSVC users to allow them to use these decision points in their SSVC + decision models without needing to implement them from scratch. + + While we are happy to resolve technical issues with these decision points as + technically implemented in the SSVC project, all suggestions for changes to the + underlying specifications or semantic content should be directed to the + maintainers of the respective projects or standards. + +!!! example "The `cvss` namespace" + + We wanted to allow SSVC users to include Common Vulnerability Scoring System + (CVSS) vector elements as [decision points](../decision_points/cvss/index.md) + in their SSVC decision models. + So we created the `cvss` namespace to contain + [decision points](../decision_points/cvss/index.md) that are + based on various versions of the CVSS. These + [decision points](../decision_points/cvss/index.md) are provided + as part of the SSVC project for convenience, but we do not maintain the + underlying CVSS specifications, their semantic content or their implementations. + Suggestions for changes to the CVSS specifications should be directed to the + [FIRST CVSS Special Interest Group](https://www.first.org/cvss/) (SIG). + +!!! note "Use of (Optional) Fragments in Registered Namespaces" + + The optional fragment string following the `#` character in a registered + namespace is used to indicate a grouping or subset of decision points within + the same namespace. + This allows us to organize decision points that are related or share a common + context within the same namespace. + +!!! example "Fragment Usage in Registered Namespaces" + + We use the `nist` namespace for decision points based on NIST standards, and + fragments to differentiate between decision points based on different NIST publications, + e.g., `nist#800-30` for decision points based on NIST Special Publication 800-30. + + We may in the future add namespaces when needed to reflect different standards + bodies like `iso-iec`, `ietf`, `oasis`, etc. We would expect to use fragments + in a similar way to differentiate between different standards or publications + from the same standards body. + +!!! question "How do I request a new registered namespace?" + + If you have a suggestion for a new registered namespace, please open an + issue in the [SSVC GitHub repository](https://github.com/CERTCC/SSVC/issues) + and provide a brief description of the namespace and its intended use. + +#### Unregistered Namespace + +Unregistered namespaces are those that are not explicitly defined in the SSVC project. +Because unregistered namespaces are not managed by the SSVC project team, +there is no strict guarantee of uniqueness across different users or organizations. +However, because we require unregistered namespaces to use reverse domain name notation, +we expect that this will rarely lead to conflicts in practice. + +!!! info "Unregistered Namespace Requirements" + + Unregistered namespaces must follow the following structure: + + - Unregistered namespaces must use the `x_` prefix. + - Following the `x_` prefix, unregistered namespaces must use reverse domain name + notation of a domain under their control to ensure uniqueness. + - After the reverse domain name, a fragment separated by `#` must follow. + - The construct of reverse domain name followed by `#` and a fragment is called `x-name`. + - For any domain using other characters, DNS Punycode must be used + - Aside from the required `x_` prefix and the fragment separator `#`, unregistered + namespaces must contain only alphanumeric characters, dots (`.`), and dashes (`-`). + +!!! note "Fragment Usage is Required in Unregistered Namespaces" + + In unregistered namespaces, the fragment is _required_. This is different from + registered namespaces, where the fragment is _optional_. + + +!!! warning "Namespace Conflicts" + + Conflicts are possible in the `x_` prefix space - especially as the control over a + domain may be transferred. + Also in tests, Organizations A and B could both choose to use + `x_example.test#test`, and there are no guarantees of global uniqueness for the + decision points in the `x_example.test#test` namespace. + +!!! info "Documentation and Test Namespaces" + + Any namespace starting with `x_example` can be used in documentation or as examples, + where a unregistered namespace is needed. + The namespace `x_example.test#test` is recommended for use in testing of current or + new SSVC related code. + The namespace `x_example.test#documentation` is recommended for use in documentation + or as examples. + +!!! tip "Test Namespace" + + The `x_example.test#test` namespace is commonly used for testing purposes and is not + intended for production use. It is used to test the SSVC framework and its components, + and may contain decision points that are not fully implemented or tested. + +### Namespace Extensions + +Namespace extensions allow users to extend the SSVC namespaces to clarify existing decision points +from a base namespace. +Extensions are optional and may be used to refine or clarify existing decision points. +Extensions allow SSVC users to create decision points that are specific to their +constituencies or to provide translations of existing decision points. + +!!! info "Namespace Extension Semantic Requirements" + + Extensions must follow the following requirements: + + - Extensions must not alter the decision point key, version number, or value keys + for any decision point they are derived from. + - Extensions must not alter the meaning of existing values, or add values to + existing decision points in the parent namespace. + - Extensions may reduce the set of values for a decision point in the parent + namespace, but must not add new values. + + See also the "Namespace Extension Structural Requirements" below. + +!!! question "Why are the Namespace Extension Semantic Requirements important?" + + The way extensions are built enables tools to process the decision points even if + they do not know the defined extension. As long as the tool knows the base + namespace, it can process the decision point. + +!!! question "What if I want to create a new decision point?" + + If you want to create a new decision point, please use an unregistered namespace + as described above instead of an extension. + Extensions are not intended to be used to create new decision points. + +#### Namespace Extension Structure + +The first extension segment is reserved for an optional BCP-47 language tag, which may be left empty. + +!!! info "Default language is `en-US`" + + If the first extension segment is left empty, the default language (`en-US`) is implied. + +Subsequent extension segments must either + +- be a valid BCP 47 language tag (marking an official translation from the previous extension segment entity), +- begin with a `.` followed by an `x-name` (reverse domain name notation string, the fragment separator `#` and a fragment), or +- be a `translation`. + +Except for the delimiters, an extension segment must not contain any other characters than alphanumeric +characters (upper or lower case), dots (`.`), and dashes (`-`). +Only a single fragment identifier (`#`) is allowed per extension segment. +Fragment segments should be used to indicate a specific interpretation or context for the extension. +Note: Without a fragment segment, all decision points of an organization would fall into one bucket, +which is in most cases not intended. Therefore, the use of a fragment segment is required from the start. + +A `translation` starts with a `.` is followed by a reverse domain name or an `x-name`. +Subsequently, a `$` followed by a valid BCP 47 language tag ends the string. +Note: If the `translation` uses just the reverse domain name followed by the language tag, +e.g. `.example.test$de-DE`, this implies an unofficial translation done by the entity in possession of that +domain name. +A `translation` using an `x-name` indicates that the extension bases of a collection that had a different language +and no formal translation was used to develop that collection. +The following diagram illustrates the structure of namespace extensions: + +```mermaid +--- +title: Namespace Extension Structure +--- +flowchart LR + +subgraph exts[Extensions] + direction LR + subgraph first[1st Extension Segment] + direction TB + lang[Language Tag] + empty_lang[Empty String] + lang ~~~|OR| empty_lang + end + subgraph ext[Subsequent Extension Segments] + direction TB + + subgraph lang_seg[Language Only Segment] + e_lang[Language Tag] + end + + subgraph e_dot[Extension Segment] + direction LR + dot[.] + reverse_ns_ext[Reverse Domain Name Notation] + fragment[#Fragment] + + dot --> reverse_ns_ext --> fragment + end + + subgraph translation[Translation Segment] + direction LR + t_dot[.] + t_reverse_ns_ext[Reverse Domain Name Notation] + t_fragment[#Fragment] + t_dollar[$] + t_lang[Language Tag] + + t_dot --> t_reverse_ns_ext -.->|optional| t_fragment -.-> t_dollar --> t_lang + t_reverse_ns_ext --> t_dollar + end + + lang_seg ~~~|OR| e_dot ~~~|OR| translation + end + first -->|/| ext + ext -->|/| ext +end + +base_ns[Base Namespace] +base_ns -->|/| first + +``` + +!!! info "Namespace Extension Structural Requirements" + + Extensions must follow the following structure: + + - Extension segments are separated by slashes (`/`). + - Multiple extension segments are allowed. + - If any extension segments are present, the first segment must be a valid BCP-47 language tag or an empty string. + - When the first segment is left as an empty string, the default language (`en-US`) is implied. + - Subsequent extension segments must begin with a reverse domain name notation string or be a valid, non-empty BCP-47 language tag. + - A fragment identifier (`#`) may be included in extension segments. + - Extension segments may contain alphanumeric characters (upper or lower case), dots (`.`), and dashes (`-`), and zero or one hash (`#`) and zero or one dollar sign (`$`). + - Extensions must not alter the decision point key, version number, or value keys for any decision point they are derived from. + - Extensions may reduce the set of values for a decision point in the parent namespace, but must not add new values. + + The structure of the namespace string is intended to show inheritance for + variations on SSVC objects. + +!!! tip "Extension Order Matters" + + SSVC namespace extension order carries semantic meaning. + + | Example | Meaning | + |---------|---------| + | `ssvc/de-DE/.example.organization#ref-arch-1` | Denotes (a) an official German (Germany) translation of the SSVC decision points is available, and (b) that this translation has been extended with an extension by `organization.example` to fit their specific needs for `ref-arch-1`.| + | `ssvc//.example.organization#ref-arch-1/de-DE` | Denotes that (a) the `.example.organization#ref-arch-1` extension is available in the default language (`en-US`), and (b) that this extension has been translated into German (Germany). | + +!!! example "Use of fragment identifiers and language tags" + + Imagine an Information Sharing and Analysis Organization (ISAO) `isao.example` + wants to create an extension to refine an existing decision point in the `ssvc` namespace + with additional context for a part of their constituency. They could create an extension + namespace like `ssvc//.example.isao#constituency` to indicate that this extension + is specifically tailored for a particular constituency within the ISAO. + Note the empty first segment, which implies the default language (`en-US`). + + If they further chose to create a Polish language version of their extension, + they would add a language segment _following_ their extension namespace, + e.g., `ssvc//.example.isao#constituency/pl-PL`. Note that this is different + from a hypothetical `ssvc/pl-PL/.example.isao#constituency` extension, which would imply + that the `ssvc` namespace has been officially translated to Polish (Poland) and then + extended (in Polish) with the `.example.isao#constituency` extension. + + It is also different from `ssvc//.example.isao$pl-PL/example.isao#constituency` which + denotes that the ISAO did a translation of the `ssvc` namespace to Polish and based + the collection for their constituency on that translation. + +!!! example "Refinement of Concepts for a Specific Constituency" + + A sector-specific information sharing and analysis organization (ISAO) + might create an extension for their specific constituency. + For example, say that a hypothetical registered namespace `foo` + has a decision point for `Regulated System=(Y,N)`. + A medical-focused ISAO might create an extension + `foo//.example.med-isao#specific-regulations` where they refine the values to refer + to specific regulations. If multiple regulatory regimes exist, they might even have + `foo//.example.med-isao#regulation-1` and `foo//.example.med-isao#regulation-2` + to cover assessment of the appropriate regulations. + +### Usage Suggestions + +Although we reserved the first segment of the extension for language tags, +there are scenarios where it may be appropriate to use a language tag in a later +segment of the extension. + +!!! tip "Use BCP-47 Language Tags" + + Regardless where they appear in the extension strings, BCP-47 language tags + must be used for any language-based extension. + Note, however that we do not yet strictly enforce this recommendation in the + SSVC codebase outside of the first extension segment. + Nevertheless, validators should check that the used strings are valid BCP-47 + language tags and exist. + +!!! example "Translation of a custom extension" + + If you have a custom extension that is not a translation of an existing + decision point, you might use a language tag in a later segment to indicate + a translation of the extension. + For example, `ssvc//.example.documentation#extension/pl-PL` would indicate that the + an extension in the default `en-US` language has been translated to Polish (Poland). + +!!! tip "Use Reverse Domain Name Notation for Extensions" + + To avoid conflicts with other users' extensions, we require the use of reverse + domain name notation for your extensions. This helps to ensure that your + extensions are unique and easily identifiable. + For example, if your organization is `documentation.example`, you might use an extension + like `ssvc//.example.documentation#extension`. + +## Technical requirements + +The following technical requirements are enforced for SSVC namespaces, +based on the implementation in `src/ssvc/namespaces.py` +and the ABNF specification in +[data/abnf/ssvc_namespace_pattern.abnf](../../../data/abnf/ssvc_namespace_pattern.abnf): + +- Namespaces must be between 3 and 1000 characters long. + +(The ABNF is used to generate the regular expressions in +`src/ssvc/utils/patterns.py`, see the comment in the source code there.) + +## The `ssvc.namespaces` module + +The `ssvc.namespaces` module provides a way to access and use these namespaces. + ::: ssvc.namespaces diff --git a/docs/reference/code/outcomes.md b/docs/reference/code/outcomes.md deleted file mode 100644 index f1a2d15c..00000000 --- a/docs/reference/code/outcomes.md +++ /dev/null @@ -1,5 +0,0 @@ -# Outcome Values and Outcome Groups - -::: ssvc.outcomes.base - -::: ssvc.outcomes.groups diff --git a/docs/reference/code/policy_generator.md b/docs/reference/code/policy_generator.md index 4520599f..23e02db3 100644 --- a/docs/reference/code/policy_generator.md +++ b/docs/reference/code/policy_generator.md @@ -1,7 +1,7 @@ # SSVC Policy Generator Tool The SSVC Policy Generator is a Python object that generates an SSVC decision -policy (a decision tree) from a set of input parameters. +table from a set of input parameters. It is intended to be used as a library, for example within a Jupyter notebook. diff --git a/docs/reference/code/selection.md b/docs/reference/code/selection.md new file mode 100644 index 00000000..f1a2c466 --- /dev/null +++ b/docs/reference/code/selection.md @@ -0,0 +1,3 @@ +# Selections + +::: ssvc.selection diff --git a/docs/reference/decision_points/automatable.md b/docs/reference/decision_points/automatable.md index 69259cfa..c20ce7c1 100644 --- a/docs/reference/decision_points/automatable.md +++ b/docs/reference/decision_points/automatable.md @@ -1,12 +1,16 @@ # Automatable (SSVC) ```python exec="true" idprefix="" -from ssvc.decision_points.automatable import LATEST +from ssvc.decision_points.ssvc.automatable import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` +!!! tip "Gathering Information about Automatable" + + See this [HowTo](../../howto/gathering_info/automatable.md) for advice on gathering information about the Automatable decision point. + !!! tip "See also" Automatable combines with [Value Density](./value_density.md) to inform @@ -43,26 +47,10 @@ Due to vulnerability chaining, there is some nuance as to whether reconnaissance This automates the _reconnaissance_ of vulnerable systems. In this situation, the analyst should continue to analyze vulnerability A to understand whether the remaining steps in the kill chain can be automated. -!!! tip "Gathering Information About Automatable" - - An analyst should be able to sketch the automation scenario and how it either does or does not satisfy each of the four kill chain steps. - Once one step is not satisfied, the analyst can stop and select [*no*](automatable.md). - Code that demonstrably automates all four kill chain steps certainly satisfies as a sketch. - We say sketch to indicate that plausible arguments, such as convincing psuedocode of an automation pathway for each step, are also adequate evidence in favor of a [*yes*](automatable.md) to *Automatable*. - - Like all SSVC decision points, *Automatable* should capture the analyst's best understanding of plausible scenarios at the time of the analysis. - An answer of *no* does not mean that it is absolutely inconceivable to automate exploitation in any scenario. - It means the analyst is not able to sketch a plausible path through all four kill chain steps. - “Plausible” sketches should account for widely deployed network and host-based defenses. - Liveness of Internet-connected services means quite a few overlapping things [@bano2018scanning]. - For most vulnerabilities, an open port does not automatically mean that reconnaissance, weaponization, and delivery are automatable. - Furthermore, discovery of a vulnerable service is not automatable in a situation where only two hosts are misconfigured to expose the service out of 2 million hosts that are properly configured. - As discussed in in [Reasoning Steps Forward](../../topics/scope.md), the analyst should consider *credible* effects based on *known* use cases of the software system to be pragmatic about scope and providing values to decision points. - ## Prior Versions ```python exec="true" idprefix="" -from ssvc.decision_points.automatable import VERSIONS +from ssvc.decision_points.ssvc.automatable import VERSIONS from ssvc.doc_helpers import prior_version, example_block versions = VERSIONS[:-1] diff --git a/docs/reference/decision_points/exploitation.md b/docs/reference/decision_points/exploitation.md index b4f93bb3..d2c0be4d 100644 --- a/docs/reference/decision_points/exploitation.md +++ b/docs/reference/decision_points/exploitation.md @@ -1,37 +1,17 @@ # Exploitation ```python exec="true" idprefix="" -from ssvc.decision_points.exploitation import LATEST +from ssvc.decision_points.ssvc.exploitation import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` -The intent of this measure is the present state of exploitation of the vulnerability. The intent is not to predict future exploitation but only to acknowledge the current state of affairs. Predictive systems, such as EPSS, could be used to augment this decision or to notify stakeholders of likely changes [@jacobs2021epss]. +!!! tip "Gathering Information about Exploitation" + + See this [HowTo](../../howto/gathering_info/exploitation.md) for advice on gathering information about the Exploitation decision point. -!!! tip "Gathering Information About Exploitation" - - [@householder2020historical] presents a method for searching the GitHub repositories of open-source exploit databases. - This method could be employed to gather information about whether *PoC* is true. - However, part (3) of *PoC* would not be represented in such a search, so more information gathering would be needed. - For part (3), one approach is to construct a mapping of CWE-IDs which - always represent vulnerabilities with well-known methods of exploitation. - We provide a list of possible CWE-IDs for this purpose below. - - Gathering information for *active* is a bit harder. - If the vulnerability has a name or public identifier (such as a CVE-ID), a search of news websites, Twitter, the vendor's vulnerability description, and public vulnerability databases for mentions of exploitation is generally adequate. - However, if the organization has the ability to detect exploitation attempts—for instance, through reliable and precise IDS signatures based on a public *PoC*—then detection of exploitation attempts also signals that *active* is the right choice. - Determining which vulnerability a novel piece of malware uses may be time consuming, requiring reverse engineering and a lot of trial and error. - Additionally, capable incident detection and analysis capabilities are required to make reverse engineering possible. - Because most organizations do not conduct these processes fully for most incidents, information about which vulnerabilities are being actively exploited generally comes from public reporting by organizations that do conduct these processes. - As long as those organizations also share detection methods and signatures, the results are usually quickly corroborated by the community. - For these reasons, we assess public reporting by established security community members to be a good information source for *active*; however, one should not assume it is complete. - - The description for *none* says that there is no **evidence** of *active* exploitation. - This framing admits that an analyst may not be able to detect or know about every attack. - Acknowledging that *Exploitation* values can change relatively quickly, we recommend conducting these searches frequently: if they can be automated to the organization's satisfaction, perhaps once a day (see also [Guidance on Communicating Results](../../howto/bootstrap/use.md)). - An analyst should feel comfortable selecting *none* if they (or their search scripts) have performed searches in the appropriate places for public *PoC*s and *active* exploitation (as described above) and found *none*. - Acknowledging that *Exploitation*. +The intent of this measure is the present state of exploitation of the vulnerability. The intent is not to predict future exploitation but only to acknowledge the current state of affairs. Predictive systems, such as EPSS, could be used to augment this decision or to notify stakeholders of likely changes [@jacobs2021epss]. ## CWE-IDs for *PoC* @@ -49,7 +29,7 @@ The table below lists CWE-IDs that could be used to mark a vulnerability as *PoC ## Prior Versions ```python exec="true" idprefix="" -from ssvc.decision_points.exploitation import VERSIONS +from ssvc.decision_points.ssvc.exploitation import VERSIONS from ssvc.doc_helpers import prior_version, example_block versions = VERSIONS[:-1] diff --git a/docs/reference/decision_points/human_impact.md b/docs/reference/decision_points/human_impact.md index 04057d11..dfa1acb9 100644 --- a/docs/reference/decision_points/human_impact.md +++ b/docs/reference/decision_points/human_impact.md @@ -1,19 +1,12 @@ # Human Impact ```python exec="true" idprefix="" -from ssvc.decision_points.human_impact import LATEST +from ssvc.decision_points.ssvc.human_impact import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` -!!! tip "See also" - - *Human Impact* is a combination of [Safety Impact](./safety_impact.md) and - [Mission Impact](./mission_impact.md) - -Note: This is a compound decision point[^1], therefore it is a notational convenience. - *Human Impact* is a combination of how a vulnerability can affect an organization's mission essential functions as well as safety considerations, whether for the organization's personnel or the public at large. We observe that the day-to-day operations of an organization often have already built in a degree of tolerance to small-scale variance in mission impacts. @@ -25,7 +18,38 @@ Even small deviations in safety are unlikely to go unnoticed or unaddressed. We suspect that the presence of regulatory oversight for safety issues and its absence at the lower end of the mission impact scale influences this behavior. Because of this higher sensitivity to safety concerns, we chose to retain a four-level resolution for the safety dimension. We then combine Mission Impact with Situated Safety impact and map them onto a 4-tiered scale (Low, Medium, High, Very High). -The mapping is shown in the table above. + +!!! tip "See also" + + *Human Impact* is a combination of [Safety Impact](./safety_impact.md) and + [Mission Impact](./mission_impact.md) + + ```python exec="true" idprefix="" + from ssvc.decision_tables.ssvc.human_impact import LATEST as DT + from ssvc.doc_helpers import example_block + + for dp in [v for k,v in DT.decision_points.items() if k != DT.outcome]: + print(example_block(dp)) + ``` + +The mapping is shown in the diagram and table below. + +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.human_impact import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +```python exec="true" idprefix="" + +from ssvc.decision_tables.ssvc.human_impact import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` [^1]: In pilot implementations of SSVC, we received feedback that organizations tend to think of mission and safety impacts as if they were combined into a single factor: in other words, the priority increases regardless which of the two impact factors was increased. @@ -47,7 +71,7 @@ see [Guidance on Communicating Results](../../howto/bootstrap/use.md). ## Prior Versions ```python exec="true" idprefix="" -from ssvc.decision_points.human_impact import VERSIONS +from ssvc.decision_points.ssvc.human_impact import VERSIONS from ssvc.doc_helpers import prior_version, example_block versions = VERSIONS[:-1] diff --git a/docs/reference/decision_points/mission_impact.md b/docs/reference/decision_points/mission_impact.md index f8b80503..85b234e4 100644 --- a/docs/reference/decision_points/mission_impact.md +++ b/docs/reference/decision_points/mission_impact.md @@ -1,12 +1,16 @@ # Mission Impact ```python exec="true" idprefix="" -from ssvc.decision_points.mission_impact import LATEST +from ssvc.decision_points.ssvc.mission_impact import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` +!!! tip "Gathering Information about Mission Impact" + + See this [HowTo](../../howto/gathering_info/mission_impact.md) for advice on gathering information about the Mission Impact decision point. + !!! tip "See also" Mission Impact combines with [Safety Impact](./safety_impact.md) to inform @@ -30,19 +34,10 @@ Private sector businesses may better align with [operational and financial impac While the processes, terminology, and audience for these different frameworks differ, they all can provide a sense of the criticality of an asset or assets within the scope of the stakeholder conducting the cyber vulnerability prioritization with SSVC. In that sense they all function quite similarly within SSVC. Organizations should use whatever is most appropriate for their stakeholder context, with Mission Essential Function analysis serving as a fully worked example in the SSVC documents. -## Gathering Information About Mission Impact - -The factors that influence the mission impact level are diverse. -The material here does not exhaustively discuss how a stakeholder should answer a question; that is a topic for future work. -At a minimum, understanding mission impact should include gathering information about the critical paths that involve vulnerable components, viability of contingency measures, and resiliency of the systems that support the mission. -There are various sources of guidance on how to gather this information; see for example the FEMA guidance in Continuity Directive 2 [@FCD2_2017] or OCTAVE FORTE [@tucker2018octave]. -This is part of risk management more broadly. -It should require the vulnerability management team to interact with more senior management to understand mission priorities and other aspects of risk mitigation. - ## Prior Versions ```python exec="true" idprefix="" -from ssvc.decision_points.mission_impact import VERSIONS +from ssvc.decision_points.ssvc.mission_impact import VERSIONS from ssvc.doc_helpers import example_block versions = VERSIONS[:-1] diff --git a/docs/reference/decision_points/outcomes.md b/docs/reference/decision_points/outcomes.md new file mode 100644 index 00000000..7d40f17d --- /dev/null +++ b/docs/reference/decision_points/outcomes.md @@ -0,0 +1,19 @@ +# Outcome Decision Points + +SSVC outcomes are just Decision Point objects. +The only distinction is that these Decision Points are usually intended to be used +as the *outputs* of a decision, whereas most other Decision Points are intended to serve as *inputs* to a decision. +However, there are use cases (e.g., [compound decision points](compound_decision_points.md)) +where an outcome of one decision may feed into another decision, so the +distinction between *input* and *output* is somewhat arbitrary. Hence, we chose to use the same +data structure for both. + +Following is a list of Decision Points often used as outcomes in SSVC decision models. + +```python exec="true" idprefix="" +from ssvc.outcomes import ALL +from ssvc.doc_helpers import example_block + +for dp in ALL: + print(example_block(dp)) +``` diff --git a/docs/reference/decision_points/public_safety_impact.md b/docs/reference/decision_points/public_safety_impact.md index 44b774b0..32d23e8b 100644 --- a/docs/reference/decision_points/public_safety_impact.md +++ b/docs/reference/decision_points/public_safety_impact.md @@ -1,7 +1,7 @@ # Public Safety Impact ```python exec="true" idprefix="" -from ssvc.decision_points.public_safety_impact import LATEST +from ssvc.decision_points.ssvc.public_safety_impact import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) @@ -9,8 +9,6 @@ print(example_block(LATEST)) {% include-markdown "../../_includes/safety_cvss_ssvc.md" %} -This is a compound decision point, therefore it is a notational convenience. - Suppliers necessarily have a rather coarse-grained perspective on the broadly defined [Safety Impact](safety_impact.md) Decision Point. Therefore we simplify the above into a binary categorization: @@ -18,10 +16,29 @@ Therefore we simplify the above into a binary categorization: [Safety Impact](safety_impact.md) table. - *Minimal* is when none do. +The mapping is shown in the diagram and table below. + +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.public_safety_impact import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +```python exec="true" idprefix="" + +from ssvc.decision_tables.ssvc.public_safety_impact import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` + ## Prior Versions ```python exec="true" idprefix="" -from ssvc.decision_points.public_safety_impact import VERSIONS +from ssvc.decision_points.ssvc.public_safety_impact import VERSIONS from ssvc.doc_helpers import example_block versions = VERSIONS[:-1] diff --git a/docs/reference/decision_points/public_value_added.md b/docs/reference/decision_points/public_value_added.md index 0284c0da..8a07a42e 100644 --- a/docs/reference/decision_points/public_value_added.md +++ b/docs/reference/decision_points/public_value_added.md @@ -1,7 +1,7 @@ # Public Value Added ```python exec="true" idprefix="" -from ssvc.decision_points.public_value_added import LATEST +from ssvc.decision_points.ssvc.public_value_added import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) diff --git a/docs/reference/decision_points/report_credibility.md b/docs/reference/decision_points/report_credibility.md index acce744c..0bd2047c 100644 --- a/docs/reference/decision_points/report_credibility.md +++ b/docs/reference/decision_points/report_credibility.md @@ -1,7 +1,7 @@ # Report Credibility ```python exec="true" idprefix="" -from ssvc.decision_points.report_credibility import LATEST +from ssvc.decision_points.ssvc.report_credibility import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) diff --git a/docs/reference/decision_points/report_public.md b/docs/reference/decision_points/report_public.md index aa795f2e..fd5df8e2 100644 --- a/docs/reference/decision_points/report_public.md +++ b/docs/reference/decision_points/report_public.md @@ -1,7 +1,7 @@ # Report Public ```python exec="true" idprefix="" -from ssvc.decision_points.report_public import LATEST +from ssvc.decision_points.ssvc.report_public import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) diff --git a/docs/reference/decision_points/safety_impact.md b/docs/reference/decision_points/safety_impact.md index 2c9418c4..128275ba 100644 --- a/docs/reference/decision_points/safety_impact.md +++ b/docs/reference/decision_points/safety_impact.md @@ -1,7 +1,7 @@ # Safety Impact ```python exec="true" idprefix="" -from ssvc.decision_points.safety_impact import LATEST +from ssvc.decision_points.ssvc.safety_impact import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) @@ -217,7 +217,7 @@ We defer this topic for now because we combine it with [*Mission Impact*](missio ## Prior Versions ```python exec="true" idprefix="" -from ssvc.decision_points.safety_impact import VERSIONS +from ssvc.decision_points.ssvc.safety_impact import VERSIONS from ssvc.doc_helpers import example_block versions = VERSIONS[:-1] diff --git a/docs/reference/decision_points/supplier_cardinality.md b/docs/reference/decision_points/supplier_cardinality.md index ccd088fa..6c27a0f3 100644 --- a/docs/reference/decision_points/supplier_cardinality.md +++ b/docs/reference/decision_points/supplier_cardinality.md @@ -1,7 +1,7 @@ # Supplier Cardinality ```python exec="true" idprefix="" -from ssvc.decision_points.supplier_cardinality import LATEST +from ssvc.decision_points.ssvc.supplier_cardinality import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) diff --git a/docs/reference/decision_points/supplier_contacted.md b/docs/reference/decision_points/supplier_contacted.md index f75e1615..d8bcbdcf 100644 --- a/docs/reference/decision_points/supplier_contacted.md +++ b/docs/reference/decision_points/supplier_contacted.md @@ -1,7 +1,7 @@ # Supplier Contacted ```python exec="true" idprefix="" -from ssvc.decision_points.supplier_contacted import LATEST +from ssvc.decision_points.ssvc.supplier_contacted import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) diff --git a/docs/reference/decision_points/supplier_engagement.md b/docs/reference/decision_points/supplier_engagement.md index c8a7426b..35b395d7 100644 --- a/docs/reference/decision_points/supplier_engagement.md +++ b/docs/reference/decision_points/supplier_engagement.md @@ -1,7 +1,7 @@ # Supplier Engagement ```python exec="true" idprefix="" -from ssvc.decision_points.supplier_engagement import LATEST +from ssvc.decision_points.ssvc.supplier_engagement import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) diff --git a/docs/reference/decision_points/supplier_involvement.md b/docs/reference/decision_points/supplier_involvement.md index d4fb9d70..519db57b 100644 --- a/docs/reference/decision_points/supplier_involvement.md +++ b/docs/reference/decision_points/supplier_involvement.md @@ -1,7 +1,7 @@ # Supplier Involvement ```python exec="true" idprefix="" -from ssvc.decision_points.supplier_involvement import LATEST +from ssvc.decision_points.ssvc.supplier_involvement import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) diff --git a/docs/reference/decision_points/system_exposure.md b/docs/reference/decision_points/system_exposure.md index 9a2f52dd..32742d87 100644 --- a/docs/reference/decision_points/system_exposure.md +++ b/docs/reference/decision_points/system_exposure.md @@ -1,12 +1,16 @@ # System Exposure ```python exec="true" idprefix="" -from ssvc.decision_points.system_exposure import LATEST +from ssvc.decision_points.ssvc.system_exposure import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` +!!! tip "Gathering Information about System Exposure" + + See this [HowTo](../../howto/gathering_info/system_exposure.md) for advice on gathering information about the System Exposure decision point. + Measuring the attack surface precisely is difficult, and we do not propose to perfectly delineate between small and controlled access. Exposure should be judged against the system in its deployed context, which may differ from how it is commonly expected to be deployed. For example, the exposure of a device on a vehicle's CAN bus will vary depending on the presence of a cellular telemetry device on the same bus. @@ -17,34 +21,10 @@ Therefore, a deployer’s response to Exposure may change if such mitigations ar If a mitigation changes exposure and thereby reduces the priority of a vulnerability, that mitigation can be considered a success. Whether that mitigation allows the deployer to defer further action varies according to each case. -## Gathering Information About System Exposure - -*System Exposure* is primarily used by Deployers, so the question is about whether some specific system is in fact exposed, not a hypothetical or aggregate question about systems of that type. -Therefore, it generally has a concrete answer, even though it may vary from vulnerable component to vulnerable component, based on their respective configurations. - -*System Exposure* can be readily informed by network scanning techniques. -For example, if the vulnerable component is visible on [Shodan](https://www.shodan.io) or by some other external scanning service, then it is *open*. -Network policy or diagrams are also useful information sources, especially for services intentionally open to the Internet such as public web servers. -An analyst should also choose *open* for a phone or PC that connects to the web or email without the usual protections (IP and URL blocking, updated firewalls, etc.). - -Distinguishing between *small* and *controlled* is more nuanced. -If *open* has been ruled out, some suggested heuristics for differentiating the other two are as follows. -Apply these heuristics in order and stop when one of them applies. - -- If the system's networking and communication interfaces have been physically removed or disabled, choose *small*. -- If [*Automatable*](automatable.md) is [*yes*](automatable.md), then choose *controlled*. The reasoning behind this heuristic is that if reconnaissance through exploitation is automatable, then the usual deployment scenario exposes the system sufficiently that access can be automated, which contradicts the expectations of *small*. -- If the vulnerable component is on a network where other hosts can browse the web or receive email, choose *controlled*. -- If the vulnerable component is in a third party library that is unreachable because the feature is unused in the surrounding product, choose *small*. - -The unreachable vulnerable component scenario may be a point of concern for stakeholders like patch suppliers who often find it more cost-effective to simply update the included library to an existing fixed version rather than try to explain to customers why the vulnerable code is unreachable in their own product. -In those cases, we suggest the stakeholder reviews the decision outcomes of the tree to ensure the appropriate action is taken (paying attention to [*defer*](../../howto/supplier_tree.md) vs [*scheduled*](../../howto/supplier_tree.md), for example). - -If you have suggestions for further heuristics, or potential counterexamples to these, please describe the example and reasoning in an issue on the [SSVC GitHub](https://github.com/CERTCC/SSVC/issues). - ## Prior Versions ```python exec="true" idprefix="" -from ssvc.decision_points.system_exposure import VERSIONS +from ssvc.decision_points.ssvc.system_exposure import VERSIONS from ssvc.doc_helpers import example_block versions = VERSIONS[:-1] diff --git a/docs/reference/decision_points/technical_impact.md b/docs/reference/decision_points/technical_impact.md index 4b1dcaf6..da37a6a3 100644 --- a/docs/reference/decision_points/technical_impact.md +++ b/docs/reference/decision_points/technical_impact.md @@ -1,12 +1,16 @@ # Technical Impact ```python exec="true" idprefix="" -from ssvc.decision_points.technical_impact import LATEST +from ssvc.decision_points.ssvc.technical_impact import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` +!!! tip "Gathering Information about Technical Impact" + + See this [HowTo](../../howto/gathering_info/technical_impact.md) for advice on gathering information about the Technical Impact decision point. + When evaluating *Technical Impact*, recall the scope definition in the [Scope Section](../../topics/scope.md). Total control is relative to the affected component where the vulnerability resides. If a vulnerability discloses authentication or authorization credentials to the system, this information disclosure should also be scored as “total” if those credentials give an adversary total control of the component. @@ -15,20 +19,3 @@ As mentioned in [Current State of Practice](../../topics/state_of_practice.md), Our definition of **vulnerability** is based on the determination that some security policy is violated. We consider a security policy violation to be a technical impact—or at least, a security policy violation must have some technical instantiation. Therefore, if there is a vulnerability then there must be some technical impact. - -!!! tip "Gathering Information About Technical Impact" - - Assessing *Technical Impact* amounts to assessing the degree of control over the vulnerable component the attacker stands to gain by exploiting the vulnerability. - One way to approach this analysis is to ask whether the control gained is *total* or not. - If it is not total, it is *partial*. - If an answer to one of the following questions is _yes_, then control is *total*. - After exploiting the vulnerability, - - - can the attacker install and run arbitrary software? - - can the attacker trigger all the actions that the vulnerable component can perform? - - does the attacker get an account with full privileges to the vulnerable component (administrator or root user accounts, for example)? - - This list is an evolving set of heuristics. - If you find a vulnerability that should have *total* *Technical Impact* but that does not answer yes to any of - these questions, please describe the example and what question we might add to this list in an issue on the - [SSVC GitHub](https://github.com/CERTCC/SSVC/issues). diff --git a/docs/reference/decision_points/utility.md b/docs/reference/decision_points/utility.md index 1c465d41..360ed883 100644 --- a/docs/reference/decision_points/utility.md +++ b/docs/reference/decision_points/utility.md @@ -1,7 +1,7 @@ # Utility ```python exec="true" idprefix="" -from ssvc.decision_points.utility import LATEST +from ssvc.decision_points.ssvc.utility import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) @@ -29,6 +29,25 @@ This framing makes it easier to analytically derive these categories from a desc Roughly, *Utility* is a combination of two things: (1) the value of each exploitation event and (2) the ease and speed with which the adversary can cause exploitation events. We define *Utility* as laborious, efficient, or super effective, as described in the table above. +The mapping is shown in the diagram and table below. + +```python exec="true" idprefix="" +from ssvc.decision_tables.ssvc.utility import LATEST as DT +from ssvc.decision_tables.helpers import mapping2mermaid, mermaid_title_from_dt + +rows = DT.mapping +title = mermaid_title_from_dt(DT) +print(mapping2mermaid(rows, title=title)) +``` + +```python exec="true" idprefix="" + +from ssvc.decision_tables.ssvc.utility import LATEST as DT +from ssvc.decision_tables.helpers import dt2df_md + +print(dt2df_md(DT)) +``` + ## Alternative Utility Outputs Alternative heuristics can plausibly be used as proxies for adversary utility. @@ -46,7 +65,7 @@ However, future work should look for and prevent large mismatches between the ou ## Previous Versions ```python exec="true" idprefix="" -from ssvc.decision_points.utility import VERSIONS +from ssvc.decision_points.ssvc.utility import VERSIONS from ssvc.doc_helpers import example_block versions = VERSIONS[:-1] diff --git a/docs/reference/decision_points/value_density.md b/docs/reference/decision_points/value_density.md index 11b02a3b..46c20668 100644 --- a/docs/reference/decision_points/value_density.md +++ b/docs/reference/decision_points/value_density.md @@ -1,12 +1,16 @@ # Value Density (SSVC) ```python exec="true" idprefix="" -from ssvc.decision_points.value_density import LATEST +from ssvc.decision_points.ssvc.value_density import LATEST from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` +!!! tip "Gathering Information about Value Density" + + See this [HowTo](../../howto/gathering_info/value_density.md) for advice on gathering information about the Value Density decision point. + !!! tip "See also" Value Density combines with [Automatability](./automatable.md) to inform @@ -35,19 +39,3 @@ print(example_block(LATEST)) not because each phone’s messaging history has a particularly large amount of data, but because it is uniquely valuable to law enforcement. - -!!! tip "Gathering Information About Value Density" - - The heuristics presented in the *Value Density* definitions involve whether the system is usually maintained by a dedicated professional, although we have noted some exceptions (such as encrypted mobile messaging applications). - If there are additional counterexamples to this heuristic, please describe them and the reasoning why the system should have the alternative decision value in an issue on the [SSVC GitHub](https://github.com/CERTCC/SSVC/issues). - - An analyst might use market research reports or Internet telemetry data to assess an unfamiliar product. - Organizations such as Gartner produce research on the market position and product comparisons for a large variety of systems. - These generally identify how a product is deployed, used, and maintained. - An organization's own marketing materials are a less reliable indicator of how a product is used, or at least how the organization expects it to be used. - - Network telemetry can inform how many instances of a software system are connected to a network. - Such telemetry is most reliable for the supplier of the software, especially if software licenses are purchased and checked. - Measuring how many instances of a system are in operation is useful, but having more instances does not mean that the software is a densely valuable target. - However, market penetration greater than approximately 75% generally means that the product uniquely serves a particular market segment or purpose. - This line of reasoning is what supports a determination that an ubiquitous encrypted mobile messaging application should be considered to have a *concentrated* Value Density. diff --git a/docs/reference/index.md b/docs/reference/index.md index 26a2efc0..d87b8feb 100644 --- a/docs/reference/index.md +++ b/docs/reference/index.md @@ -4,7 +4,7 @@ This section assumes that you are already familiar with SSVC and want to look up specific details. - If you are new to SSVC, you may want to start with the [Learning SSVC](../tutorials/index.md) section. + If you are new to SSVC, you may want to start with the [Learning SSVC](../tutorials/ssvc_overview.md) section. If you are already familiar with SSVC and want to learn more, you may want to start with either the [Understanding SSVC](../topics/index.md) or [SSVC How To](../howto/index.md) sections. diff --git a/docs/ssvc-calc/css.css b/docs/ssvc-calc/css.css index 833e01bd..f147c57b 100644 --- a/docs/ssvc-calc/css.css +++ b/docs/ssvc-calc/css.css @@ -1,4 +1,4 @@ -/* css version 2.2.9 */ +/* css version 2.2.10 */ #helper { background-color: rgba(255,255,255,0.95); border: 1px solid grey; @@ -464,3 +464,7 @@ pre { textPath { cursor: pointer; } +.blackbody .swal2-popup { + background: #222; + color: #eee; +} diff --git a/docs/ssvc-calc/findex.html b/docs/ssvc-calc/findex.html index 4bdeaf63..c695dcf1 100644 --- a/docs/ssvc-calc/findex.html +++ b/docs/ssvc-calc/findex.html @@ -52,9 +52,10 @@ + -