-
Couldn't load subscription status.
- Fork 1.4k
Description
The cvssBelow suppression rule does allow filtering based on the CVSS Score of a vulnerability.
From looking at the documentation, it is not clear which version of cvss is taken into account but I'm assuming that the v2 score is used.
Some vulnerability may have a very different score between v2 and v3 (e.g. CVE-2020-5529 with a CVSSv2 base score of 6.8 and a CVSSv3 score of 8.1).
Being able to specify the targeted version in the suppression rule would allow a better/more up to date filtering.
This could be exposed either as a different suppression rule (cvssV3Below) or by adding an optional version attribute to the existing cvssBelow element.