Scoring Methodology

def _calculate_foundational_completeness(cve, cna):
    descriptions = cna.get('descriptions', [])
    affected = cna.get('affected', [])
    references = cna.get('references', [])
    
    has_descriptions = isinstance(descriptions, list) and len(descriptions) > 0
    has_affected = isinstance(affected, list) and len(affected) > 0
    has_references = isinstance(references, list) and len(references) > 0
    
    return 50 if (has_descriptions and has_affected and has_references) else 0

def _calculate_root_cause_analysis(cve, cna):
    problem_types = cna.get('problemTypes', [])
    if not isinstance(problem_types, list):
        return 0
    
    has_valid_cwe = _find_valid_cwe(problem_types)
    return 15 if has_valid_cwe else 0

def _find_valid_cwe(problem_types):
    for problem_type in problem_types:
        descriptions = problem_type.get('descriptions', [])
        for desc in descriptions:
            cwe_id = desc.get('cweId', '')
            if _is_valid_cwe_id(cwe_id):
                return True
    return False

def _is_valid_cwe_id(cwe_raw):
    if not isinstance(cwe_raw, str):
        return False
    
    # Check format: CWE-[digits]
    import re
    if not re.match(r'^CWE-\d+$', cwe_raw, re.IGNORECASE):
        return False
    
    # Check against official CWE database
    return cwe_raw.upper() in scoring_config.valid_cwe_ids

def _calculate_severity_context(cve, cna):
    metrics = cna.get('metrics', [])
    if not isinstance(metrics, list):
        return 0
    
    has_cvss = _has_cvss_metrics(metrics)
    has_vector = _has_valid_cvss_vector(metrics)
    
    return 15 if (has_cvss and has_vector) else 0

def _has_cvss_metrics(metrics):
    for metric in metrics:
        if any(version in metric for version in ['cvssV3_0', 'cvssV3_1', 'cvssV4_0']):
            return True
    return False

def _has_valid_cvss_vector(metrics):
    for metric in metrics:
        for version in ['cvssV3_0', 'cvssV3_1', 'cvssV4_0']:
            if version in metric:
                cvss_data = metric[version]
                if isinstance(cvss_data, dict) and cvss_data.get('vectorString'):
                    return True
    return False

def _calculate_software_identification(cve, cna):
    affected = cna.get('affected', [])
    if not isinstance(affected, list):
        return 0
    
    has_cpe = _has_cpe_identifiers(affected)
    return 10 if has_cpe else 0

def _has_cpe_identifiers(affected):
    for product in affected:
        if not isinstance(product, dict):
            continue
        
        cpes = product.get('cpes')
        if isinstance(cpes, list) and len(cpes) > 0:
            return True
    
    return False

def _calculate_actionable_intelligence(cve, cna):
    references = cna.get('references', [])
    if not isinstance(references, list):
        return 0
    
    has_patch_ref = _has_patch_references(references)
    return 10 if has_patch_ref else 0

def _has_patch_references(references):
    for ref in references:
        if not isinstance(ref, dict):
            continue
        
        tags = ref.get('tags', [])
        if not isinstance(tags, list):
            continue
        
        # Check for patch-related tags (case-insensitive)
        for tag in tags:
            if isinstance(tag, str) and 'patch' in tag.lower():
                return True
    
    return False

{
  "foundationalCompleteness": {
    "weight": 50,
    "criteria": ["descriptions", "affected", "references"],
    "binary": true
  },
  "rootCauseAnalysis": {
    "weight": 15,
    "criteria": ["validCWE"],
    "binary": true
  },
  "severityAndImpactContext": {
    "weight": 15,
    "criteria": ["cvssV3or4", "validVector"],
    "binary": true
  },
  "softwareIdentification": {
    "weight": 10,
    "criteria": ["validCPE"],
    "binary": true
  },
  "patchinfo": {
    "weight": 10,
    "criteria": ["patchRef"],
    "binary": true
  }
}