You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The cvssBelow suppression rule does allow filtering based on the CVSS Score of a vulnerability.
From looking at the documentation, it is not clear which version of cvss is taken into account but I'm assuming that the v2 score is used.
Some vulnerability may have a very different score between v2 and v3 (e.g. CVE-2020-5529 with a CVSSv2 base score of 6.8 and a CVSSv3 score of 8.1).
Being able to specify the targeted version in the suppression rule would allow a better/more up to date filtering.
This could be exposed either as a different suppression rule (cvssV3Below) or by adding an optional version attribute to the existing cvssBelow element.
InsomniaCoder, ognjen-it, alismirnov, stefanrybacki and thomasredlin