Swap CVSS Scores to Decimal to preserve accuracy

Found in some reports and cases CVSS SCores were losing enough accuracy to slip under some thresholds. These are typically numbers only with 1 decimal point
digitalcoyote · Jun 1, 2024 · 686e2b8 · 686e2b8
1 parent 530bf5b
commit 686e2b8
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/Src/CoreTests/VulnerabilityDataTests.cs b/Src/CoreTests/VulnerabilityDataTests.cs
@@ -87,7 +87,7 @@ public void IgnoreCves()
                             "CVE-Test",
                             new Vulnerability(
                                 "CVE-Test",
-                                4.0,
+                                4.0M,
                                 "Test-CWE",
                                 "Test Description",
                                 new[] {"Test Reference"},

diff --git a/Src/NuGetDefense.Core/NuGetDefense.Core.csproj b/Src/NuGetDefense.Core/NuGetDefense.Core.csproj
@@ -3,9 +3,9 @@
     <PropertyGroup>
         <LangVersion>12</LangVersion>
         <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
-        <PackageVersion>2.0.12</PackageVersion>
-        <AssemblyVersion>2.0.12</AssemblyVersion>
-        <PackageVersion>2.0.12</PackageVersion>
+        <PackageVersion>2.0.13</PackageVersion>
+        <AssemblyVersion>2.0.13</AssemblyVersion>
+        <PackageVersion>2.0.13</PackageVersion>
         <TargetFrameworks>net6.0;net8.0</TargetFrameworks>
         <Nullable>enable</Nullable>
         <Copyright>Curtis Carter 2024</Copyright>

diff --git a/Src/NuGetDefense.Core/Vulnerability.cs b/Src/NuGetDefense.Core/Vulnerability.cs
@@ -12,14 +12,14 @@ public enum AccessVectorType
         }
 
         public readonly string Cve;
-        public readonly double CvssScore;
+        public readonly decimal CvssScore;
         public readonly string Cwe;
         public readonly string Description;
         public readonly string[] References;
         public readonly AccessVectorType Vector;
         public readonly string Vendor;
 
-        public Vulnerability(string cve, double cvssScore, string cwe, string description, string[] references, AccessVectorType vector, string vendor)
+        public Vulnerability(string cve, decimal cvssScore, string cwe, string description, string[] references, AccessVectorType vector, string vendor)
         {
             Cve = cve;
             CvssScore = cvssScore;