Prefer CVSS v3 score over v2 and add cvss_version to ticket details

cisagov · May 10, 2022 · 2b81487 · 2b81487
1 parent d5e722e
commit 2b81487
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/cyhy/db/ticket_manager.py b/cyhy/db/ticket_manager.py
@@ -96,7 +96,8 @@ def __generate_ticket_details(self, vuln, ticket, check_for_changes=True):
 
         new_details = {
             "cve": vuln.get("cve"),
-            "cvss_base_score": vuln["cvss_base_score"],
+            "cvss_base_score": vuln.get("cvss3_base_score", vuln["cvss_base_score"]),
+            "cvss_version": "3" if "cvss3_base_score" in vuln else "2",
             "kev": False,
             "name": vuln["plugin_name"],
             "score_source": vuln["source"],
@@ -108,6 +109,7 @@ def __generate_ticket_details(self, vuln, ticket, check_for_changes=True):
             cve_doc = self.__db.CVEDoc.find_one({"_id": vuln["cve"]})
             if cve_doc:
                 new_details["cvss_base_score"] = cve_doc["cvss_score"]
+                new_details["cvss_version"] = cve_doc["cvss_version"]
                 new_details["score_source"] = "nvd"
                 new_details["severity"] = cve_doc["severity"]
             # if the CVE is listed in the KEV collection, we'll mark it as such