Cvss Bundle Laravel Package

Product Decisions This Supports

• Severity normalization in a findings pipeline. CVSS gives you one comparable 0–10 score and a canonical vector string (CVSS:3.1/AV:N/AC:L/...) across heterogeneous sources — scanner output, pentest PDFs, researcher submissions. A CVSS parser is what lets you store, validate, and re-derive severity instead of trusting a free-text "High" field. This is the difference between a searchable/filterable findings table and a spreadsheet.
• Remediation SLA policy. If you want "Critical = 7 days, High = 30 days, Medium = 90 days" as an enforced product behavior (due dates, escalation notifications, aging reports), you need programmatic score computation — including temporal and environmental metrics so a customer's own exposure can move a 7.5 down to 5.4 without re-triaging.
• Bug bounty / vulnerability disclosure triage. Tiered payouts, duplicate detection, and scope decisions are all keyed to CVSS. A parser lets researchers submit a vector that you validate and score server-side rather than hand-entering numbers an analyst can fat-finger.
• Compliance and customer reporting. PCI DSS 4.0 explicitly names CVSS as a prioritization method; NIS2, SOC 2 evidence, and enterprise security questionnaires increasingly ask for it. Emitting a vector + score alongside every finding is cheap if you own the scoring code and expensive if you're doing it by hand at report time.
• Build-vs-buy on the scoring layer itself. This package is a useful forcing function: CVSS base scoring is deterministic arithmetic against a published spec — a few hundred lines with a lookup table. That's a strong argument for owning the parser and not owning the standard.

When to Consider This Package

Adopt only if:

• You are running a Symfony 2.x application (2.7/2.8) and this bundle is already in your composer.json or is the path of least resistance for a legacy service that needs scoring "this sprint."
• You need a reference implementation to read while writing your own — the DI wiring shows how the domain is meant to be composed, and the underlying YesWeHack CVSS library is the real asset.
• Your needs are strictly CVSS v2/v3 base scores and you accept that you're vendoring dead code.

Look elsewhere (the default answer) if:

• You are on Symfony 4/5/6/7, Laravel, or anything else — this bundle is Symfony2-specific and will not autowire; the integration layer is worthless to you even if the domain isn't.
• You need CVSS v4.0. A Symfony2-era bundle predates it. v4.0 also changes the math (macrovector-based), so old parsers will silently mis-score.
• You are parsing untrusted input (researcher-submitted vector strings). An unmaintained package is a poor place to put your input-validation boundary — no security patches, no fuzzing, no CVE process.
• You need temporal/environmental metrics, multi-vector merging, or per-tenant scoring overrides. You'll be extending the codebase immediately, at which point the bundle's value is negative.
• Your team has no appetite to maintain a forked dependency on an EOL framework line.

The realistic alternative: depend on the underlying scoring library directly (framework-agnostic), evaluate FIRST's reference implementations, or implement the spec in-house against the published equations plus the official test vectors. Because there are 0 dependents and no visible maintenance signal, treat adoption as "vendoring," not "buying" — budget for ownership from day one.

How to Pitch It (Stakeholders)

Executives: The capability — standardized, auditable vulnerability severity — is a real product requirement, driven by customer procurement (PCI DSS 4.0 names CVSS) and by the fact that our competitors ship severity-tiered SLAs and risk dashboards. The package is not the answer: it's a Symfony 2 integration for a framework line that reached end-of-life in 2019, with no dependents and no maintenance signal. Recommendation: adopt the standard, not this bundle. We standardize on CVSS v3.1 (with a v4.0 migration path) and build a small, owned scoring service in our current stack. Estimated cost is small and bounded — CVSS base scoring is deterministic math against a published spec with official test vectors — and it removes a dead-framework dependency from a security-sensitive code path.

Engineering: ywh/cvss-bundle is a thin Symfony2 DI wrapper around YesWeHack's CVSS domain library. Worth 30 minutes as a reference read; not worth a dependency. It pins us to an EOL Symfony kernel, has no v4.0 support, and puts third-party, unmaintained code on our untrusted-input boundary (researcher-supplied vector strings). Plan: implement or vendor a framework-agnostic scorer, validate against the official FIRST test vectors in CI, and expose it behind an internal SeverityScorer interface so the standard's next revision is a swap, not a rewrite.