-
Type: Bug
-
Status: Closed
-
Priority: Major
-
Resolution: Unresolved
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: None
-
Labels:None
-
Proposal:
-
Resolution:
From Harold Booth: I am afraid I missed the opportunity to mention concerns...I have one suggested change: line 456 in vuln.xsd should be: <xs:element name="ScoreSetV3" minOccurs="0" maxOccurs="unbounded"> to not require CVSSv3
I believe the intent is:
For each vulnerability in a CVRF document
CVSSScoreSets are optional, there can be 0 or 1
there can be 0 or more CVSSv2 scores
there can be 0 or more CVSSv3 scores
for either v2 or v3 there must be 1 and only 1 Base score
other CVSS scores and the vectors are optional
This means there can be one CVSS base score but more than one vector, or more than one Temporal score per vulnerability?