CVSS Score 2

Author: martindg

trainingportal/qna.js

@@ -235,6 +235,10 @@ let cvss_score_1 = () => {
   return {"digest": getDigest("CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N")};
 }
 
+let cvss_score_2 = () => {
+  return {"digest": getDigest("CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N")};
+}
+
 const DEFS = {
   "crypto_caesar": caesarEnc,
   "crypto_vigenere": vigenereEnc,
@@ -244,7 +248,8 @@ const DEFS = {
   "crypto_xor": xorEnc,
   "crypto_pbk": pbkEnc,
   "crypto_analysis": analysisEnc,
-  "cvss_score_1": cvss_score_1
+  "cvss_score_1": cvss_score_1,
+  "cvss_score_2": cvss_score_2
 }
 
 module.exports = {

trainingportal/static/lessons/cvss/cvss_score_2.md

@@ -0,0 +1,7 @@
+### Task
+
+Score the following scenario using the CVSS v4.0 calculator [https://www.first.org/cvss/calculator/4-0](https://www.first.org/cvss/calculator/4-0).
+
+### Scenario
+
+A malicious SaaS user with knowledge of another user’s unique 128-bit userid, can read all the information (e.g. details, activity, messages) for that user through an Authorization bypass in the API.

trainingportal/static/lessons/cvss/cvss_score_2.sol.md

@@ -0,0 +1,11 @@
+- Attack Vector (AV): Network (N)
+- Attack Complexity (AC): High (H)
+- Attack Requirements (AT): None (N)
+- Privileges Required (PR): Low (L)
+- User Interaction (UI): None (N)
+- Vulnerable System Confidentiality (VC): High (H)
+- Vulnerable System Integrity (VI): None (N)
+- Vulnerable System Availability (VA): None (N)
+- Subsequent System Confidentiality (SC): None (N)
+- Subsequent System Integrity (SI): None (N)
+- Subsequent System Availability (SA): None (N)

trainingportal/static/lessons/cvss/definitions.json

@@ -67,6 +67,15 @@
                 "type":"quiz",
                 "mission":"Enter the CVSS v4 string (Base Score)",
                 "codeBlockIds":[]
+            },
+            {
+                "id":"cvss_score_2",
+                "name":"Score Vulnerability 2",
+                "description": "cvss_score_2.md",
+                "solution": "cvss_score_2.sol.md",
+                "type":"quiz",
+                "mission":"Enter the CVSS v4 string (Base Score)",
+                "codeBlockIds":[]
             }
         ]
     }