Skip to content

Need a cvssV3Below or a cvssBelow(version=xx) suppression rule #2563

@arnaudq

Description

@arnaudq

The cvssBelow suppression rule does allow filtering based on the CVSS Score of a vulnerability.

From looking at the documentation, it is not clear which version of cvss is taken into account but I'm assuming that the v2 score is used.

Some vulnerability may have a very different score between v2 and v3 (e.g. CVE-2020-5529 with a CVSSv2 base score of 6.8 and a CVSSv3 score of 8.1).

Being able to specify the targeted version in the suppression rule would allow a better/more up to date filtering.

This could be exposed either as a different suppression rule (cvssV3Below) or by adding an optional version attribute to the existing cvssBelow element.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions