prefer nvd score if both nvd and vendor cvss v3 scores exist (#1080)

aquasecurity · Mar 21, 2023 · f57815e · f57815e
1 parent eec5594
commit f57815e
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 5 deletions.
diff --git a/pkg/plugins/trivy/plugin.go b/pkg/plugins/trivy/plugin.go
@@ -2069,11 +2069,11 @@ func GetScoreFromCVSS(CVSSs map[string]*CVSS) *float64 {
 		}
 	}
 
-	if vendorScore != nil {
-		return vendorScore
+	if nvdScore != nil {
+		return nvdScore
 	}
 
-	return nvdScore
+	return vendorScore
 }
 
 func GetMirroredImage(image string, mirrors map[string]string) (string, error) {

diff --git a/pkg/plugins/trivy/plugin_test.go b/pkg/plugins/trivy/plugin_test.go
@@ -6673,7 +6673,7 @@ func TestGetScoreFromCVSS(t *testing.T) {
 		expectedScore *float64
 	}{
 		{
-			name: "Should return vendor score when vendor v3 score exist",
+			name: "Should return nvd score when nvd and vendor v3 score exist",
 			cvss: dbtypes.VendorCVSS{
 				"nvd": {
 					V3Score: 8.1,
@@ -6682,7 +6682,7 @@ func TestGetScoreFromCVSS(t *testing.T) {
 					V3Score: 8.3,
 				},
 			},
-			expectedScore: pointer.Float64(8.3),
+			expectedScore: pointer.Float64(8.1),
 		},
 		{
 			name: "Should return nvd score when vendor v3 score is nil",
@@ -6705,6 +6705,15 @@ func TestGetScoreFromCVSS(t *testing.T) {
 			},
 			expectedScore: pointer.Float64(8.1),
 		},
+		{
+			name: "Should return vendor score when nvd doesn't exist",
+			cvss: dbtypes.VendorCVSS{
+				"redhat": {
+					V3Score: 8.1,
+				},
+			},
+			expectedScore: pointer.Float64(8.1),
+		},
 		{
 			name: "Should return nil when vendor and nvd both v3 scores are nil",
 			cvss: dbtypes.VendorCVSS{