fix: use CvssV4

jeremylong · Dec 7, 2024 · fe3ad9b · fe3ad9b
1 parent 2b21c7b
commit fe3ad9b
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java b/core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
@@ -518,6 +518,9 @@ public int compareTo(@NotNull Vulnerability o) {
      * vulnerability severity
      */
     private Double bestEffortSeverityLevelForSorting() {
+        if (this.cvssV4 != null) {
+            return SeverityUtil.sortAdjustedCVSSv3BaseScore(this.cvssV4.getCvssData().getBaseScore());
+        }
         if (this.cvssV3 != null) {
             return SeverityUtil.sortAdjustedCVSSv3BaseScore(this.cvssV3.getCvssData().getBaseScore());
         }
@@ -535,6 +538,9 @@ private Double bestEffortSeverityLevelForSorting() {
      * unscored severities that critical is assumed.
      */
     public String getHighestSeverityText() {
+        if (this.cvssV4 != null) {
+            return this.cvssV4.getCvssData().getBaseSeverity().value().toUpperCase();
+        }
         if (this.cvssV3 != null) {
             return this.cvssV3.getCvssData().getBaseSeverity().value().toUpperCase();
         }