Skip to content

Suggest improvements form drops the CVSS 3.1 vector when an advisory has both 3.1 and 4.0 #9628

Description

@nikpivkin

I used the "Suggest improvements for this vulnerability" form on GHSA-984m-rj28-8c6x to change the range of one entry. I did not touch the severity. But the pull request #9627 also removes the CVSS_V3 entry and keeps only CVSS_V4. Here is the part of its diff.

   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
-    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"

The advisory has both vectors. The form has a "Severity" select with "Assess severity using CVSS v4" and one "Vector string" field, so it can hold only one vector. When I submit the form, the other vector is lost.

I expect the form to keep the CVSS 3.1 vector when I do not edit the severity.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions