Scoring Methodology

def _calculate_foundational_completeness(cve, cna):
    descriptions = cna.get('descriptions', [])
    affected = cna.get('affected', [])
    references = cna.get('references', [])
    
    has_descriptions = isinstance(descriptions, list) and len(descriptions) > 0
    has_affected = isinstance(affected, list) and len(affected) > 0
    has_references = isinstance(references, list) and len(references) > 0
    
    return 50 if (has_descriptions and has_affected and has_references) else 0

def _calculate_root_cause_analysis(cve, cna):
    problem_types = cna.get('problemTypes', [])
    if not isinstance(problem_types, list):
        return 0
    
    has_valid_cwe = _find_valid_cwe(problem_types)
    return 15 if has_valid_cwe else 0

def _find_valid_cwe(problem_types):
    for problem_type in problem_types:
        descriptions = problem_type.get('descriptions', [])
        for desc in descriptions:
            cwe_id = desc.get('cweId', '')
            if _is_valid_cwe_id(cwe_id):
                return True
    return False

def _is_valid_cwe_id(cwe_raw):
    if not isinstance(cwe_raw, str):
        return False
    
    # Check format: CWE-[digits]
    import re
    if not re.match(r'^CWE-\d+$', cwe_raw, re.IGNORECASE):
        return False
    
    # Check against official CWE database
    return cwe_raw.upper() in scoring_config.valid_cwe_ids

def _calculate_severity_context(cve, cna):
    metrics = cna.get('metrics', [])
    if not isinstance(metrics, list):
        return 0
    
    has_cvss = _has_cvss_metrics(metrics)
    has_vector = _has_valid_cvss_vector(metrics)
    
    return 15 if (has_cvss and has_vector) else 0

def _has_cvss_metrics(metrics):
    for metric in metrics:
        if any(version in metric for version in ['cvssV3_0', 'cvssV3_1', 'cvssV4_0']):
            return True
    return False

def _has_valid_cvss_vector(metrics):
    for metric in metrics:
        for version in ['cvssV3_0', 'cvssV3_1', 'cvssV4_0']:
            if version in metric:
                cvss_data = metric[version]
                if isinstance(cvss_data, dict) and cvss_data.get('vectorString'):
                    return True
    return False

def _calculate_software_identification(cve, cna):
    # Check traditional affected[].cpes field
    affected = cna.get('affected', [])
    if isinstance(affected, list):
        has_cpe_in_affected = _has_cpe_identifiers(affected)
        if has_cpe_in_affected:
            return 10
    
    # Check CVE 5.1 cpeApplicability field
    has_cpe_applicability = _has_cpe_applicability(cna)
    if has_cpe_applicability:
        return 10
    
    return 0

def _has_cpe_identifiers(affected):
    """Check for traditional CPE lists in affected products"""
    for product in affected:
        if not isinstance(product, dict):
            continue
        
        cpes = product.get('cpes')
        if isinstance(cpes, list) and len(cpes) > 0:
            return True
    
    return False

def _has_cpe_applicability(cna):
    """Check for CVE 5.1 cpeApplicability with advanced matching"""
    cpe_applicability = cna.get('cpeApplicability', [])
    
    for item in cpe_applicability:
        nodes = item.get('nodes', [])
        for node in nodes:
            cpe_match = node.get('cpeMatch', [])
            for match in cpe_match:
                if isinstance(match, dict) and match.get('criteria'):
                    return True
    
    return False

{
  "cpeApplicability": [
    {
      "nodes": [
        {
          "operator": "OR",
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vendor:product:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.2.3"
            }
          ]
        }
      ]
    }
  ]
}

def _calculate_actionable_intelligence(cve, cna):
    references = cna.get('references', [])
    if not isinstance(references, list):
        return 0
    
    has_patch_ref = _has_patch_references(references)
    return 10 if has_patch_ref else 0

def _has_patch_references(references):
    for ref in references:
        if not isinstance(ref, dict):
            continue
        
        tags = ref.get('tags', [])
        if not isinstance(tags, list):
            continue
        
        # Check for patch-related tags (case-insensitive)
        for tag in tags:
            if isinstance(tag, str) and 'patch' in tag.lower():
                return True
    
    return False

{
  "foundationalCompleteness": {
    "weight": 50,
    "criteria": ["descriptions", "affected", "references"],
    "binary": true
  },
  "rootCauseAnalysis": {
    "weight": 15,
    "criteria": ["validCWE"],
    "binary": true
  },
  "severityAndImpactContext": {
    "weight": 15,
    "criteria": ["cvssV3or4", "validVector"],
    "binary": true
  },
  "softwareIdentification": {
    "weight": 10,
    "criteria": ["validCPE"],
    "binary": true
  },
  "patchinfo": {
    "weight": 10,
    "criteria": ["patchRef"],
    "binary": true
  }
}