Enum ExploitMaturity 

#[repr(u8)]
pub enum ExploitMaturity {
    NotDefined = 0,
    Attacked = 1,
    ProofOfConcept = 2,
    Unreported = 3,
}

Metric::ExploitMaturity (E) values.

Description

This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation. Public availability of easy-to-use exploit code or exploitation instructions increases the number of potential attackers by including those who are unskilled. Initially, real-world exploitation may only be theoretical. Publication of proof-of-concept exploit code, functional exploit code, or sufficient technical details necessary to exploit the vulnerability may follow. Furthermore, the available exploit code or instructions may progress from a proof-of-concept demonstration to exploit code that is successful in exploiting the vulnerability consistently. In severe cases, it may be delivered as the payload of a network-based worm or virus or other automated attack tools.

It is the responsibility of the CVSS consumer to populate the values of Exploit Maturity (E) based on information regarding the availability of exploitation code/processes and the state of exploitation techniques. This information will be referred to as “threat intelligence” throughout this document.

Operational Recommendation: Threat intelligence sources that provide Exploit Maturity information for all vulnerabilities should be preferred over those with only partial coverage. Also, it is recommended to use multiple sources of threat intelligence as many are not comprehensive. This information should be updated as frequently as possible and its application to CVSS assessment should be automated.

Properties

• Metric Group: Threat Metrics
• Documentation: CVSS v4.0 Specification, Section 3.1: Exploit Maturity (E)

Examples

Parse string as metric:

// parse string as metric
let metric: Metric = "E:A".parse()?;

// check result
assert_eq!(metric, Metric::ExploitMaturity(ExploitMaturity::Attacked));

Convert metric to string:

// convert metric to string
let s = Metric::ExploitMaturity(ExploitMaturity::ProofOfConcept).to_string();

// check result
assert_eq!(s, "E:P");

Get metric name:

// get metric name
let name = Name::from(Metric::ExploitMaturity(ExploitMaturity::Unreported));

// check result
assert_eq!(name, Name::ExploitMaturity);

Variants

NotDefined = 0

Not Defined (X)

Reliable threat intelligence is not available to determine Exploit Maturity characteristics. This is the default value and is equivalent to Attacked (A) for the purposes of the calculation of the score by assuming the worst case.

Attacked = 1

Attacked (A)

Based on available threat intelligence either of the following must apply:

• Attacks targeting this vulnerability (attempted or successful) have been reported
• Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)

ProofOfConcept = 2

Proof-of-Concept (P)

Based on available threat intelligence each of the following must apply:

• Proof-of-concept exploit code is publicly available
• No knowledge of reported attempts to exploit this vulnerability
• No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)

Unreported = 3

Unreported (U)

Based on available threat intelligence each of the following must apply:

• No knowledge of publicly available proof-of-concept exploit code
• No knowledge of reported attempts to exploit this vulnerability
• No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)

Trait Implementations

impl Clone for ExploitMaturity

fn clone(&self) -> ExploitMaturity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ExploitMaturity

impl Debug for ExploitMaturity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ExploitMaturity

impl PartialEq for ExploitMaturity

fn eq(&self, other: &ExploitMaturity) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ExploitMaturity