CVSS v1.0

CVSS::V1::Vector class and metric enums

`CVSS::V1::Vector`

v = CVSS::V1::Vector.parse("(AV:R/AC:L/Au:NR/C:C/I:C/A:C/B:N)")
v.base_score          # => 10.0
v.severity            # => CVSS::Severity::High
v.b                   # => CVSS::V1::ImpactBias::Normal
v.to_h                # => {"AV"=>"R","AC"=>"L","Au"=>"NR","C"=>"C","I"=>"C","A"=>"C","B"=>"N"}

Vector notation

The FIRST v1.0 guide never standardised a vector string. The notation this class parses and emits is NVD's, documented while NVD published v1 scores (nvd.nist.gov/cvss.cfm?vectorinfo) and adopted by every v1-era publisher:

(AV:[R,L]/AC:[H,L]/Au:[R,NR]/C:[N,P,C]/I:[N,P,C]/A:[N,P,C]/B:[N,C,I,A])

Temporal metrics are appended inside the same parentheses:

/E:[U,P,F,H]/RL:[O,T,W,U]/RC:[U,Uc,C]

parse additionally accepts the metric list without its parentheses and with a CVSS:1.0/ prefix; to_s always emits the canonical parenthesised form.

NVD never published a vector form for the environmental group, so CDP and TD use the short codes CVSS v2.0 later gave them. Vectors that omit them round-trip byte-for-byte either way.

Class methods

Method	Description
`parse(input : String) : Vector`	Strict parse. Raises on malformed input. Parentheses and a `CVSS:1.0/` prefix are both optional.
`parse?(input : String) : Vector?`	Non-raising variant.

Constructor

CVSS::V1::Vector.new(
  av:, ac:, au:, c:, i:, a:, b:,
  e: nil, rl: nil, rc: nil,
  cdp: nil, td: nil,
)

Scoring

Method	Description
`base_score : Float64`	FIRST CVSS v1.0 formula, including the Impact Bias re-weighting.
`temporal_score : Float64`	Falls back to `base_score` when no temporal metrics are set.
`environmental_score : Float64`	Falls back to `temporal_score` when no environmental metrics are set. Returns `0.0` when `TD:N`.

Severity

Method	Description
`severity : Severity`	Maps the base score to `None`/`Low`/`Medium`/`High`. v1 has no Critical band.
`temporal_severity : Severity`
`environmental_severity : Severity`

Classification helpers

Method	Returns
`remote?` / `network?` / `local?`	`Bool`. `network?` is an alias for `remote?` — v1's "Remote" is what v2.0 renamed to "Network".
`requires_authentication?`	`Bool` (true when `Au:R`)
`impacts_confidentiality?` / `impacts_integrity?` / `impacts_availability?`	`Bool`

Serialization

Method	Description
`to_s(io : IO) : Nil` / `to_s : String`	Emits the canonical parenthesised vector string.
`to_h : Hash(String, String)`	Metric short-codes. Optional metrics omitted when not set.
`to_json(json : JSON::Builder) : Nil`	NVD-shaped object. Adds `temporalScore`/`environmentalScore` only when set.
`metric_value(name : String) : String`	Short-code for one metric. Unset optional metrics report `"ND"` — a library sentinel, since v1.0 has no NotDefined code of its own.

Metric enums

All accept parse(s : String) : Self and code : String. Every enum except ImpactBias also exposes weight : Float64.

Enum	Codes
`AccessVector`	`L` Local (0.7), `R` Remote (1.0)
`AccessComplexity`	`H` High (0.8), `L` Low (1.0)
`Authentication`	`R` Required (0.6), `NR` NotRequired (1.0)
`Impact` (C/I/A)	`N` None (0), `P` Partial (0.7), `C` Complete (1.0)
`ImpactBias`	`N` Normal, `C` Confidentiality, `I` Integrity, `A` Availability
`Exploitability`	`U` Unproven, `P` ProofOfConcept, `F` Functional, `H` High
`RemediationLevel`	`O` OfficialFix, `T` TemporaryFix, `W` Workaround, `U` Unavailable
`ReportConfidence`	`U` Unconfirmed, `Uc` Uncorroborated, `C` Confirmed
`CollateralDamagePotential`	`N`, `L`, `M`, `H`
`TargetDistribution`	`N`, `L`, `M`, `H`

`ImpactBias`

Impact Bias is unique to v1.0 — it re-weights the three impact sub-scores against one another rather than contributing a single weight, so it exposes three accessors instead of weight:

Bias	`conf_weight`	`integ_weight`	`avail_weight`
`Normal`	0.333	0.333	0.333
`Confidentiality`	0.5	0.25	0.25
`Integrity`	0.25	0.5	0.25
`Availability`	0.25	0.25	0.5

v2.0 dropped the metric; the same idea returned as the environmental CR/IR/AR security requirements.