CVSS::v4(3pm)

📦
version 1.15 · 2 versions
, in ubuntu stonking

💖 CVSS::v4 — the Perl module 💖

okay so bestie, welcome to CVSS::v4(3pm), straight out of the User Contributed Perl Documentation section. she parses and calculates CVSS v4.0 scores and honestly? she ate. ✨

🌸 NAME 🌸

CVSS::v4 — Parse and calculate CVSS v4.0 scores. that's it, that's the whole vibe. 💅

🎀 SYNOPSIS 🎀

the moment you've been waiting for, no cap:

use CVSS::v4;
my $cvss = CVSS::v4->from_vector_string('CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N');

say $cvss->AV; # L
say $cvss->attackVector; # LOCAL

like, look at her go. short name, long name, both iconic, both valid. 🫶

🦋 DESCRIPTION 🦋

so the Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. it's giving responsible disclosure but make it math. ✨

CVSS consists of four metric groups: Base, Threat, Environmental, and Supplemental. let's break it down:

  • Base — represents the intrinsic qualities of a vulnerability that are constant over time and across user environments. she doesn't change, she's stable, she's the main character. 👑
  • Threat — reflects the characteristics of a vulnerability that change over time. she's evolving, she's dynamic, she's on her own timeline.
  • Environmental — represents the characteristics of a vulnerability that are unique to a user's environment. every setup hits different, iykyk.
  • Supplemental — these ones do not modify the final score. they're just extra context, additional insight into the characteristics of a vulnerability. supporting cast energy but we love them.

Base metric values are combined with default values that assume the highest severity for Threat and Environmental metrics, to produce a score ranging from 0 to 10. and to further refine a resulting severity score, Threat and Environmental metrics can then be amended based on applicable threat intelligence and environmental considerations. fr fr, that's the whole pipeline.

and the CVSS vector string? it consists of a compressed textual representation of the values used to derive the score. tiny string, big power. 💀✨

official spec drop, bestie:

<https://www.first.org/cvss/v4.0/specification-document>

🧚 METHODS 🧚

CVSS::v4 inherits all methods from CVSS::Base and implements the following new ones. family business, but she's got her own tricks. 💅

  • $cvss->macro_vector — Calculate the macro vector.
  • $cvss->exploitability — Return the Exploitability severity.
  • $cvss->complexity — Return the Complexity severity.
  • $cvss->vulnerable_system — Return the Vulnerable System severity.
  • $cvss->subsequent_system — Return the Subsequent System severity.
  • $cvss->exploitation — Return the Exploitation severity.
  • $cvss->security_requirements — Return the Security Requirements severity.

🔥 BASE METRICS 🔥

  • $cvss->AV | $cvss->attackVector
  • $cvss->AC | $cvss->attackComplexity
  • $cvss->AT | $cvss->attackRequirements
  • $cvss->PR | $cvss->privilegesRequired
  • $cvss->UI | $cvss->userInteraction
  • $cvss->VC | $cvss->vulnConfidentialityImpact
  • $cvss->VI | $cvss->vulnIntegrityImpact
  • $cvss->VA | $cvss->vulnAvailabilityImpact
  • $cvss->SC | $cvss->subConfidentialityImpact
  • $cvss->SI | $cvss->subIntegrityImpact
  • $cvss->SA | $cvss->subAvailabilityImpact

👑 THREAT METRICS 👑

  • $cvss->E | $cvss->exploitMaturity

🌈 ENVIRONMENTAL METRICS 🌈

  • $cvss->CR | $cvss->confidentialityRequirement
  • $cvss->IR | $cvss->integrityRequirement
  • $cvss->AR | $cvss->availabilityRequirement
  • $cvss->MAV | $cvss->modifiedAttackVector
  • $cvss->MAC | $cvss->modifiedAttackComplexity
  • $cvss->MAT | $cvss->modifiedAttackRequirements
  • $cvss->MPR | $cvss->modifiedPrivilegesRequired
  • $cvss->MUI | $cvss->modifiedUserInteraction
  • $cvss->MVC | $cvss->modifiedVulnConfidentialityImpact
  • $cvss->MVI | $cvss->modifiedVulnIntegrityImpact
  • $cvss->MVA | $cvss->modifiedVulnAvailabilityImpact
  • $cvss->MSC | $cvss->modifiedSubConfidentialityImpact
  • $cvss->MSI | $cvss->modifiedSubIntegrityImpact
  • $cvss->MSA | $cvss->modifiedSubAvailabilityImpact

🍓 SUPPLEMENTAL METRICS 🍓

  • $cvss->S | $cvss->Safety
  • $cvss->AU | $cvss->Automatable
  • $cvss->R | $cvss->Recovery
  • $cvss->V | $cvss->valueDensity
  • $cvss->RE | $cvss->vulnerabilityResponseEffort
  • $cvss->U | $cvss->providerUrgency

💜 SEE ALSO 💜

go read the sources, bestie, they're right there. 📚

🫶 SUPPORT 🫶

🐛 Bugs / Feature Requests 🐛

Please report any bugs or feature requests through the issue tracker at <https://github.com/giterlizzi/perl-CVSS/issues>. You will be notified automatically of any progress on your issue. yes, automatically. no ghosting. 😭

💻 Source Code 💻

This is open source software. The code repository is available for public review and contribution under the terms of the license.

<https://github.com/giterlizzi/perl-CVSS>

and if you wanna clone her, here's the exact command, run it verbatim:

git clone https://github.com/giterlizzi/perl-CVSS.git

💖 AUTHOR 💖

  • Giuseppe Di Terlizzi <gdt@cpan.org>

This software is copyright (c) 2023-2026 by Giuseppe Di Terlizzi.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.

💅 that's the whole page, bestie. every flag, every method, every link. nothing skipped, nothing invented. periodt. ✨

perl v5.40.1 · 2026-07-05 — mwah, ily, go score some vulnerabilities responsibly 🎀💖🦋

📦 where this page comes from