CVSS::Base(3pm)

📦
version 1.15 · 2 versions
, in ubuntu stonking

💖 NAME 💖

CVSS::Base — the base class for CVSS, bestie. The blueprint. The mother of all the CVSS classes. 👑

🦋 DESCRIPTION 🦋

okay so basically this is the base class that CVSS::v2, CVSS::v3 and CVSS::v4 all inherit their whole personality from. every one of them builds on this. it's giving founding mother energy, fr fr. 💅

✨ METHODS ✨

  • $cvss->version — hands you the CVSS version. that's it, that's the vibe.
  • $cvss->vector_string — gives you back the CVSS vector string so you can flex the whole thing in one line. 🎀
  • $cvss->metrics — gives you the HASH of CVSS metrics. all of them. the full set. no crumbs. 🌈

🌸 SCORE & SEVERITY 🌸

  • $cvss->scores — returns the HASH of the calculated score (base, impact, temporal, etc.). it's the lil report card for your whole calculation, and honestly? she ate.
$scores = $cvss->scores;

say Dumper($scores);

# { "base"           => "7.4",
#   "exploitability" => "1.6",
#   "impact"         => "5.9" }
  • $cvss->calculate_score — does the actual calculation of the score, following the CVSS specification to the letter. no shortcuts, no vibes-based math, all spec. 🔥
  • $cvss->score_to_severity ( $score ) — converts a score into a severity. glow-up for numbers: $score walks in as a 7.4 and walks out as HIGH. ✨
  • $cvss->base_score — returns the base score (0 - 10).
  • $cvss->base_severity — returns the base severity (LOW, MEDIUM, HIGH or CRITICAL).
  • $cvss->temporal_score — returns the temporal score (0 - 10) — (CVSS 2.0/3.x)
  • $cvss->temporal_severity — returns the temporal severity (LOW, MEDIUM, HIGH or CRITICAL) — (CVSS 2.0/3.x)
  • $cvss->environmental_score — returns the environmental score (0 - 10) — (CVSS 2.0/3.x)
  • $cvss->environmental_severity — returns the environmental severity (LOW, MEDIUM, HIGH or CRITICAL) — (CVSS 2.0/3.x)
  • $cvss->impact_score — returns the impact score (0 - 10) — (CVSS 2.0/3.x)
  • $cvss->exploitability_score — returns the exploitability score (0 - 10) — (CVSS 2.0/3.x)
  • $cvss->modified_impact_score — returns the modified impact score (0 - 10) — (CVSS 2.0/3.x)

🧚 METRICS 🧚

  • $cvss->M ( $metric ) — returns the metric value, but make it short. abbreviation mode. it's giving minimalism.
say $cvss->M('AV'); # A
  • $cvss->metric ( $metric ) — returns the metric value, but make it long. the full name, no abbreviation nonsense.
say $cvss->metric('AV'); # ADJACENT_NETWORK
  • $cvss->metric_group_is_set ( $group ) — the original docs don't say a single word about what this does beyond the name, and honestly bestie same 😭. so that's all we're telling you — no invented lore here.

💜 DATA REPRESENTATIONS 💜

  • $cvss->to_vector_string — converts the CVSS object into a vector string. object → slay string, one line, iconic.
say $cvss->to_vector_string; # CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

# or

say $cvss; # CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
say $cvss->to_xml;

# <?xml version="1.0" encoding="UTF-8"?>
# <cvssv3.1 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd"
#   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
#   xsi:schemaLocation="https://www.first.org/cvss/cvss-v3.1.xsd https://www.first.org/cvss/cvss-v3.1.xsd"
#   >
#
#   <base_metrics>
#     <attack-vector>ADJACENT_NETWORK</attack-vector>
#     <attack-complexity>LOW</attack-complexity>
#     <privileges-required>LOW</privileges-required>
#     <user-interaction>REQUIRED</user-interaction>
#     <scope>UNCHANGED</scope>
#     <confidentiality-impact>HIGH</confidentiality-impact>
#     <integrity-impact>HIGH</integrity-impact>
#     <availability-impact>HIGH</availability-impact>
#     <base-score>7.4</base-score>
#     <base-severity>HIGH</base-severity>
#   </base_metrics>
#
# </cvssv3.1>
use Mojo::JSON qw(encode_json);

say encode_json($cvss);

# {
#    "attackComplexity" : "LOW",
#    "attackVector" : "ADJACENT_NETWORK",
#    "availabilityImpact" : "HIGH",
#    "baseScore" : 7.4,
#    "baseSeverity" : "HIGH",
#    "confidentialityImpact" : "HIGH",
#    "integrityImpact" : "HIGH",
#    "privilegesRequired" : "LOW",
#    "scope" : "UNCHANGED",
#    "userInteraction" : "REQUIRED",
#    "vectorString" : "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
#    "version" : "3.1"
# }

👑 CONSTANTS 👑

  • $cvss->ATTRIBUTES — returns the HASH of all metrics in { "JSON name" => "metric", ... } format.
  • $cvss->METRIC_GROUPS — returns the HASH of the metric group (base, environmental, temporal, etc.) and its metrics.
  • $cvss->METRIC_NAMES — returns the HASH of the names of all metric values.
  • $cvss->METRIC_VALUES — returns the HASH of all metric values.
  • $cvss->NOT_DEFINED_VALUE — returns the NOT_DEFINED vector value ("ND" or "X").
  • $cvss->SCORE_SEVERITY — returns the HASH of { severity => { min => score, max => score }, ... }, and yes, it's the one score_to_severity uses. 👀
  • $cvss->VECTOR_STRING_REGEX — returns the Vector String REGEX.

🌟 SEE ALSO 🌟

CVSS::v2, CVSS::v3, CVSS::v4 — the whole friend group. go say hi. 🫶

💅 SUPPORT 💅

🐛 Bugs / Feature Requests 🐛

found a bug? got a feature request burning a hole in your notes app? please report it through the issue tracker at https://github.com/giterlizzi/perl-CVSS/issues. you'll get notified automatically about any progress on your issue — so you never have to sit there refreshing and wondering. 😌

🍓 Source Code 🍓

this is open source software, bestie. the code repository is out there for public review and contribution under the terms of the license.

https://github.com/giterlizzi/perl-CVSS

git clone https://github.com/giterlizzi/perl-CVSS.git

⭐ AUTHOR ⭐

  • Giuseppe Di Terlizzi <gdt@cpan.org>

This software is copyright (c) 2023-2025 by Giuseppe Di Terlizzi.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.

and that's the whole page, bestie!! 🎀 this one came to you courtesy of the User Contributed Perl Documentation, running on perl v5.40.1, dated 2026-07-05 — mwah, go forth and calculate some scores 💖

📦 where this page comes from