[ https://issues.oasis-open.org/browse/CSAF-21?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=65995#comment-65995 ]
Art MANION commented on CSAF-21:
--------------------------------
I believe this was resolved at the April 26 2017 meeting.
> Zero or more CVSSv3 scores, overall CVSS logic
> ----------------------------------------------
>
> Key: CSAF-21
> URL: https://issues.oasis-open.org/browse/CSAF-21
> Project: OASIS Common Security Advisory Framework (CSAF) TC
> Issue Type: Bug
> Reporter: Art MANION
> Assignee: Omar Santos
>
> From [~harold.booth]: I am afraid I missed the opportunity to mention concerns...I have one suggested change: line 456 in vuln.xsd should be: <xs:element name="ScoreSetV3" minOccurs="0" maxOccurs="unbounded"> to not require CVSSv3
> I believe the intent is:
> For each vulnerability in a CVRF document
> CVSSScoreSets are optional, there can be 0 or 1
> there can be 0 or more CVSSv2 scores
> there can be 0 or more CVSSv3 scores
> for either v2 or v3 there must be 1 and only 1 Base score
> other CVSS scores and the vectors are optional
> This means there can be one CVSS base score but more than one vector, or more than one Temporal score per vulnerability?
--
This message was sent by Atlassian JIRA
(v6.2.2#6258)
