nvd_cvss/v3/
attack_complexity.rs

1//! ### 2.1.2. Attack Complexity (AC)
2//!
3//! This metric describes the conditions beyond the attacker’s control that must exist in order to knowledge_base the vulnerability. As described below, such conditions may require the collection of more information about the target, or computational exceptions. Importantly, the assessment of this metric excludes any requirements for user interaction in order to knowledge_base the vulnerability (such conditions are captured in the User Interaction metric). If a specific configuration is required for an attack to succeed, the Base metrics should be scored assuming the vulnerable component is in that configuration. The Base Score is greatest for the least complex attacks. The list of possible values is presented in Table 2.
4//!
5//! **Table 2: Attack Complexity**
6//!
7//! | Metric Value | Description |
8//! | --- | --- |
9//! | Low (L) | Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component. |
10//! | High (H) | A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.\[^2\] For example, a successful attack may depend on an attacker overcoming any of the following conditions:<br>*   The attacker must gather knowledge about the environment in which the vulnerable target/component exists. For example, a requirement to collect details on target configuration settings, sequence numbers, or shared secrets.<br>*   The attacker must prepare the target environment to improve knowledge_base reliability. For example, repeated exploitation to win a race condition, or overcoming advanced knowledge_base mitigation techniques.<br>*   The attacker must inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).|
11//!
12//! _Scoring Guidance_: When deciding between Network and Adjacent, if an attack can be launched over a wide area network or from outside the logically adjacent administrative network domain, use Network. Network should be used even if the attacker is required to be on the same intranet to knowledge_base the vulnerable system (e.g., the attacker can only knowledge_base the vulnerability from inside a corporate network).
13//!
14use std::fmt::{Display, Formatter};
15use std::str::FromStr;
16
17use serde::{Deserialize, Serialize};
18
19use crate::error::{CVSSError, Result};
20use crate::metric::{Help, Metric, MetricType, MetricTypeV3, Worth};
21
22/// Attack Complexity (AC) 攻击复杂度
23///
24/// 攻击复杂度为攻击者无法控制的条件，这些条件必须存在才能攻击脆弱组件。
25/// 如下文所述，这些条件可能需要预先收集有关目标或系统的配置或计算异常等更多信息。
26///
27/// > The Attack Complexity metric describes the conditions beyond the attacker's control that must
28/// > exist in order to knowledge_base the vulnerability. As described below, such conditions may require
29/// > the collection of more information about the target, the presence of certain system
30/// > configuration settings, or computational exceptions.
31#[derive(Clone, PartialEq, Debug, Deserialize, Serialize)]
32#[serde(rename_all = "UPPERCASE")]
33pub enum AttackComplexityType {
34  /// High(H) 高复杂度
35  ///
36  /// 攻击无法随意完成，攻击者在攻击成功之前，需要对脆弱组件投入大量的准备。
37  High,
38  /// Low(L) 低复杂度
39  ///
40  /// 攻击者可以随意攻击，不存在惩罚机制。
41  Low,
42}
43
44impl AttackComplexityType {
45  pub fn metric_help(&self) -> Help {
46    self.help()
47  }
48}
49impl Display for AttackComplexityType {
50  fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
51    write!(f, "{}:{}", Self::name(), self.as_str())
52  }
53}
54impl Metric for AttackComplexityType {
55  const TYPE: MetricType = MetricType::V3(MetricTypeV3::AC);
56
57  fn help(&self) -> Help {
58    match self {
59      Self::High => {Help{ worth: Worth::Bad, des: "A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.".to_string() }}
60      Self::Low => {Help{ worth: Worth::Worst, des: "Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.".to_string() }}
61    }
62  }
63
64  fn score(&self) -> f32 {
65    match self {
66      Self::High => 0.44,
67      Self::Low => 0.77,
68    }
69  }
70
71  fn as_str(&self) -> &'static str {
72    match self {
73      Self::High => "H",
74      Self::Low => "L",
75    }
76  }
77}
78impl FromStr for AttackComplexityType {
79  type Err = CVSSError;
80
81  fn from_str(s: &str) -> Result<Self> {
82    let name = Self::name();
83    let s = s.to_uppercase();
84    let (_name, v) = s
85      .split_once(&format!("{}:", name))
86      .ok_or(CVSSError::InvalidCVSS {
87        key: name.to_string(),
88        value: s.to_string(),
89        expected: name.to_string(),
90      })?;
91    let c = v.chars().next();
92    match c {
93      Some('L') => Ok(Self::Low),
94      Some('H') => Ok(Self::High),
95      _ => Err(CVSSError::InvalidCVSS {
96        key: name.to_string(),
97        value: format!("{:?}", c),
98        expected: "L,H".to_string(),
99      }),
100    }
101  }
102}
nvd_cvss/v3/attack_complexity.rs

nvd_cvss/v3/
attack_complexity.rs
