Skip to content

Instantly share code, notes, and snippets.

@topahl
Last active January 30, 2022 11:13
Show Gist options
  • Save topahl/8e8dd05fd6bcd9a7cdebb485de5ea2ee to your computer and use it in GitHub Desktop.
Save topahl/8e8dd05fd6bcd9a7cdebb485de5ea2ee to your computer and use it in GitHub Desktop.
Excel CVSS Score calculation function
Attribute VB_Name = "CVSSv2"
Function CVSSv2(AV As String, AC As String, AU As String, C As String, I As String, A As String)
Attribute CVSSv3.VB_Description = "This function calculates the CVSSv3 Score from the coresponding vector"
Attribute CVSSv3.VB_ProcData.VB_Invoke_Func = " \n9"
Dim intAV, intAC, intAU, intC, intI, intA As Double
Dim ImpactScore, ISCbase, Exploitability As Double
Select Case AV
Case "Network", "N"
intAV = 1
Case "Adjacent", "Adjacent Network", "A"
intAV = 0.646
Case "Local", "L"
intAV = 0.395
Case Else
CVSSv2 = CVErr(xlErrValue)
Exit Function
End Select
Select Case AC
Case "Low", "L"
intAC = 0.71
Case "Medium", "M"
intAC = 0.61
Case "High", "H"
intAC = 0.35
Case Else
CVSSv2 = CVErr(xlErrValue)
Exit Function
End Select
Select Case AU
Case "None", "N"
intAU = 0.704
Case "Single", "S"
intAU = 0.56
Case "Multiple", "M"
intAU = 0.45
Case Else
CVSSv2 = CVErr(xlErrValue)
Exit Function
End Select
Select Case I
Case "Complete", "C"
intI = 0.66
Case "Partial", "P"
intI = 0.275
Case "None", "N"
intI = 0
Case Else
CVSSv2 = CVErr(xlErrValue)
Exit Function
End Select
Select Case C
Case "Complete", "C"
intC = 0.66
Case "Partial", "P"
intC = 0.275
Case "None", "N"
intC = 0
Case Else
CVSSv2 = CVErr(xlErrValue)
Exit Function
End Select
Select Case A
Case "Complete", "C"
intA = 0.66
Case "Partial", "P"
intA = 0.275
Case "None", "N"
intA = 0
Case Else
CVSSv2 = CVErr(xlErrValue)
Exit Function
End Select
ImpactScore = 10.41 * (1 - (1 - intC) * (1 - intI) * (1 - intA))
Exploitability = 20 * intAV * intAC * intAU
If ImpactScore = 0 Then
CVSSv2 = 0
Else
CVSSv2 = WorksheetFunction.RoundUp(((0.6 * ImpactScore) + (0.4 * Exploitability) - 1.5) * 1.176, 1)
End If
End Function
Attribute VB_Name = "CVSSv3"
Function CVSSv3(AV As String, AC As String, PR As String, UI As String, S As String, C As String, I As String, A As String)
Attribute CVSSv3.VB_Description = "This function calculates the CVSSv2 Score from the coresponding vector"
Attribute CVSSv3.VB_ProcData.VB_Invoke_Func = " \n9"
Dim intAV, intAC, intPR, intUI, intS, intC, intI, intA As Double
Dim ImpactScore, ISCbase, Exploitability As Double
Select Case AV
Case "Network", "N"
intAV = 0.85
Case "Adjacent", "Adjacent Network", "A"
intAV = 0.62
Case "Local", "L"
intAV = 0.55
Case "Physical", "P"
intAV = 0.2
Case Else
CVSSv3 = CVErr(xlErrValue)
Exit Function
End Select
Select Case AC
Case "Low", "L"
intAC = 0.77
Case "High", "H"
intAC = 0.44
Case Else
CVSSv3 = CVErr(xlErrValue)
Exit Function
End Select
Select Case PR
Case "None", "N"
intPR = 0.85
Case "Low", "L"
If S = "Changed" Or S = "S" Then
intPR = 0.68
Else
intPR = 0.62
End If
Case "High", "H"
If S = "Changed" Or S = "S" Then
intPR = 0.5
Else
intPR = 0.27
End If
Case Else
CVSSv3 = CVErr(xlErrValue)
Exit Function
End Select
Select Case UI
Case "None", "N"
intUI = 0.85
Case "Required", "R"
intUI = 0.62
Case Else
CVSSv3 = CVErr(xlErrValue)
Exit Function
End Select
Select Case C
Case "High", "H"
intC = 0.56
Case "Low", "L"
intC = 0.22
Case "None", "N"
intC = 0
Case Else
CVSSv3 = CVErr(xlErrValue)
Exit Function
End Select
Select Case I
Case "High", "H"
intI = 0.56
Case "Low", "L"
intI = 0.22
Case "None", "N"
intI = 0
Case Else
CVSSv3 = CVErr(xlErrValue)
Exit Function
End Select
Select Case A
Case "High", "H"
intA = 0.56
Case "Low", "L"
intA = 0.22
Case "None", "N"
intA = 0
Case Else
CVSSv3 = CVErr(xlErrValue)
Exit Function
End Select
ISCbase = 1 - ((1 - intI) * (1 - intC) * (1 - intA))
Exploitability = 8.22 * intAV * intAC * intPR * intUI
If ISCbase <= 0 Then
CVSSv3 = 0
End If
Select Case S
Case "Changed", "C"
ImpactScore = 7.52 * (ISCbase - 0.029) - 3.25 * (ISCbase - 0.02) ^ 15
CVSSv3 = WorksheetFunction.RoundUp(WorksheetFunction.Min(1.08 * (ImpactScore + Exploitability), 10), 1)
Case "Unchanged", "U"
ImpactScore = 6.42 * ISCbase
CVSSv3 = WorksheetFunction.RoundUp(WorksheetFunction.Min(ImpactScore + Exploitability, 10), 1)
Case Else
CVSSv3 = CVErr(xlErrValue)
Exit Function
End Select
End Function
Attribute VB_Name = "CVSSv3Rage"
Function CVSSv3Range(args As range)
Attribute CVSSv3.VB_Description = "This function calculates the CVSSv3 Score from the coresponding vector provided by a range instead of individual cells"
Attribute CVSSv3.VB_ProcData.VB_Invoke_Func = " \n9"
Dim myarr As Variant
Dim mystr(8) As String
myarr = args.Value
mystr(1) = myarr(1, 1)
mystr(2) = myarr(1, 2)
mystr(3) = myarr(1, 3)
mystr(4) = myarr(1, 4)
mystr(5) = myarr(1, 5)
mystr(6) = myarr(1, 6)
mystr(7) = myarr(1, 7)
mystr(8) = myarr(1, 8)
CVSSv3Range = CVSSv3(mystr(1), mystr(2), mystr(3), mystr(4), mystr(5), mystr(6), mystr(7), mystr(8))
End Function
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment