CVSS(3pm)

📦
version 1.15 · 2 versions
, in ubuntu stonking

✨ CVSS 💖

okay bestie, gather round, because this is the CVSS page from the User Contributed Perl Documentation and it's literally the moment your whole vulnerability-scoring life levels up. it's CVSS(3pm), it's a Perl extension, and it does CVSS (Common Vulnerability Scoring System) 2.0 / 3.x / 4.0. no cap. 🎀

🌸 NAME 🌸

CVSS — a Perl extension for CVSS (Common Vulnerability Scoring System) 2.0 / 3.x / 4.0. it's giving calculator, it's giving vector-string whisperer, it's giving everything. 💅

✨ SYNOPSIS ✨

here's the whole vibe, verbatim, no notes:

use CVSS;

# OO-interface

# Method 1 - Use params

$cvss = CVSS->new(
  version => '3.1',
  metrics => {
      AV => 'A',
      AC => 'L',
      PR => 'L',
      UI => 'R',
      S => 'U',
      C => 'H',
      I => 'H',
      A => 'H',
  }
);

# Method 2 - Decode and parse the vector string

use CVSS;

$cvss = CVSS->from_vector_string('CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H');

say $cvss->base_score; # 7.4

# Method 3 - Builder

use CVSS

$cvss = CVSS->new(version => '3.1');
$cvss->attackVector('ADJACENT_NETWORK');
$cvss->attackComplexity('LOW');
$cvss->privilegesRequired('LOW');
$cvss->userInteraction('REQUIRED');
$cvss->scope('UNCHANGED');
$cvss->confidentialityImpact('HIGH');
$cvss->integrityImpact('HIGH');
$cvss->availabilityImpact('HIGH');

$cvss->calculate_score;

# Common methods

# Convert the CVSS object in "vector string"
say $cvss; # CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

# Get metric value
say $cvss->AV; # A
say $cvss->attackVector; # ADJACENT_NETWORK

# Get the base score
say $cvss->base_score; # 7.4

# Get all scores
say Dumper($cvss->scores);

# { "base"           => "7.4",
#   "exploitability" => "1.6",
#   "impact"         => "5.9" }

# Get the base severity
say $cvss->base_severity # HIGH

# Convert CVSS in XML in according of CVSS XML Schema Definition
$xml = $cvss->to_xml;

# Convert CVSS in JSON in according of CVSS JSON Schema
$json = encode_json($cvss);

# exported functions

use CVSS qw(decode_cvss encode_cvss)

$cvss = decode_cvss('CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H');
say $cvss->base_score;  # 7.4

$vector_string = encode_cvss(version => '3.1', metrics => {...});
say $cvss_string; # CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

🦋 DESCRIPTION 🦋

so. what does this module actually do? it calculates the CVSS (Common Vulnerability Scoring System) scores — that's basic, temporal, and environmental — it converts the "vector string", and it hands you back the CVSS object as JSON or XML. iconic behaviour tbh. 🔥

and like, why do we care? because CVSS gives you a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. then that numerical score can be translated into a qualitative representation (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes. it's literally the adult-in-the-room of vuln triage. 🌈

<https://www.first.org/cvss/>

🧚 FUNCTIONAL INTERFACE

these ones are exported by default, bestie — you don't even have to ask:

  • $vector_string = encode_cvss(%params) — converts the given CVSS params to "vector string". Croaks on error. 😭

this function call is functionally identical to:

$vector_string = CVSS->new(%params)->to_string;
  • $cvss = decode_cvss($vector_string) — converts the given "vector string" to CVSS. Croaks on error.

this function call is functionally identical to:

$cvss = CVSS->from_vector_string($vector_string);
  • $xml = cvss_to_xml($vector_string) — converts the given "vector string" to XML. Croaks on error.

this function call is functionally identical to:

$xml = $cvss->to_xml;

👑 OBJECT-ORIENTED INTERFACE

  • $cvss = CVSS->new(%params) — creates a new CVSS instance using the provided parameters (version, metric or vector_string) and returns the CVSS subclass that matches the selected CVSS version (2.0, 3.0, 3.1 or 4.0). it's literally picking your own main character. 💖

and here's the match-up, since tables aren't it in this format — read it as a lil' lineup:

+--------------+----------+
| CVSS version | Class    |
+--------------+----------+
| 2.0          | CVSS::v2 |
| 3.0          | CVSS::v3 |
| 3.1          | CVSS::v3 |
| 4.0          | CVSS::v4 |
+--------------+----------+
  • $cvss = CVSS->from_vector_string($vector_string); — converts the given "vector string" to CVSS. Croaks on error (no period, that's the original, we don't fix things here). 🫶

🌟 SEE ALSO 🌟

go read the siblings, they're all slaying:

  • CVSS::Base, CVSS::v2, CVSS::v3, CVSS::v4

and the source material, straight from FIRST:

💜 ACKNOWLEDGEMENTS 💜

not to brag but— okay, lowkey to brag: this module is listed in the CVSS v4.0 Frequently Asked Questions by FIRST.Org (Forum of Incident Response and Security Teams) as a community CVSS calculator library. famous. periodt. 👑

<https://www.first.org/cvss/v4.0/faq#List-of-Calculator-Libraries>

🎀 SUPPORT 🎀

🐛 Bugs / Feature Requests

please report any bugs or feature requests through the issue tracker at <https://github.com/giterlizzi/perl-CVSS/issues>. You will be notified automatically of any progress on your issue. we keep you in the loop, bestie. 💌

📦 Source Code

this is open source software. the code repository is available for public review and contribution under the terms of the license.

<https://github.com/giterlizzi/perl-CVSS>

git clone https://github.com/giterlizzi/perl-CVSS.git

🌸 AUTHOR 🌸

  • Giuseppe Di Terlizzi <gdt@cpan.org>

this software is copyright (c) 2023-2026 by Giuseppe Di Terlizzi.

this is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.

💌 and that's the whole page, bestie! this was perl v5.40.1, dated 2026-07-05, from the CVSS(3pm) manual. go forth, score some vulns, stay iconic. 💅✨🦋
📦 where this page comes from