find_cvss_combinations.py

import csv
import sys
from itertools import product
from cvss import CVSS3

# Check if a CVSS score was provided as a command-line argument
if len(sys.argv) != 2:
    print(f'Usage: {sys.argv[0]} <cvss_score>')
    sys.exit(1)

# Parse the CVSS score
try:
    target_score = float(sys.argv[1])
except ValueError:
    print(f'Error: Invalid CVSS score "{sys.argv[1]}"')
    sys.exit(1)

# Define the possible values for each CVSS metric
attack_vector = ['N', 'A', 'L', 'P']
attack_complexity = ['L', 'H']
privileges_required = ['N', 'L', 'H']
user_interaction = ['N', 'R']
scope = ['U', 'C']
confidentiality_impact = ['N', 'L', 'H']
integrity_impact = ['N', 'L', 'H']
availability_impact = ['N', 'L', 'H']

# Create a CSV writer that writes to STDOUT
writer = csv.writer(sys.stdout)
writer.writerow(['Attack Vector', 'Attack Complexity', 'Privileges Required', 'User Interaction', 'Scope', 'Confidentiality Impact', 'Integrity Impact', 'Availability Impact', 'CVSS Score'])

# Generate all combinations of CVSS metrics
for av, ac, pr, ui, s, ci, ii, ai in product(attack_vector, attack_complexity, privileges_required, user_interaction, scope, confidentiality_impact, integrity_impact, availability_impact):
    # Calculate the CVSS score for the current combination of metrics
    vector = f'CVSS:3.1/AV:{av}/AC:{ac}/PR:{pr}/UI:{ui}/S:{s}/C:{ci}/I:{ii}/A:{ai}'
    score = CVSS3(vector).scores()[0]

    # If the calculated score matches the target score, write the combination of metrics to STDOUT
    if score == target_score:
        writer.writerow([av, ac, pr, ui, s, ci, ii, ai, score])