com.h3xstream.maven.victims.CveVulnerability Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of security-versions Show documentation

Maven plugin that identify vulnerable libraries in Maven dependencies

The newest version!

package com.h3xstream.maven.victims;

import java.util.List;

public class CveVulnerability {
    private String cveId;
    private String title;
    private String description;
    private String cvssScore;
    private List references;
    private List affectedVersions;

    public CveVulnerability(String cveId, String title, String description, String cvssScore, List references, List affectedVersions) {
        this.cveId = cveId;
        this.title = title;
        this.description = description;
        this.cvssScore = cvssScore;
        this.references = references;
        this.affectedVersions = affectedVersions;
    }

    public String getCveId() {
        return cveId;
    }

    public void setCveId(String cveId) {
        this.cveId = cveId;
    }

    public String getTitle() {
        return title;
    }

    public void setTitle(String title) {
        this.title = title;
    }

    public String getDescription() {
        return description;
    }

    public void setDescription(String description) {
        this.description = description;
    }

    public String getCvssScore() {
        return cvssScore;
    }

    public void setCvssScore(String cvssScore) {
        this.cvssScore = cvssScore;
    }

    public List getReferences() {
        return references;
    }

    public void setReferences(List references) {
        this.references = references;
    }

    public List getAffectedVersions() {
        return affectedVersions;
    }

    public void setAffectedVersions(List affectedVersions) {
        this.affectedVersions = affectedVersions;
    }

    public String getCvssLevel() {
        //1. Vulnerabilities are labeled "Low" severity if they have a CVSS base score of 0.0-3.9.
        //2. Vulnerabilities will be labeled "Medium" severity if they have a base CVSS score of 4.0-6.9.
        //3. Vulnerabilities will be labeled "High" severity if they have a CVSS base score of 7.0-10.0.
        try {
            Double value = Double.valueOf(cvssScore);
            if(0 <= value && value < 4.0) {
                return "low";
            }
            else if(4.0 <= value && value < 7.0) {
                return "medium";
            }
            else if(7.0 <= value && value < 9.0) {
                return "high";
            }
            else if(9.0 <= value && value <= 10.0) {
                return "critical";
            }
        }
        catch (Exception e) {}
        return "unknown"; //Unknown
    }
}