https://spdx.org/rdf/3.0.1/terms/Security/CvssV4VulnAssessmentRelationship
Provides a CVSS version 4 assessment for a vulnerability.
By the associated SHACL property shapes, instances of security:CvssV4VulnAssessmentRelationship can have the following properties:
| PROPERTY | PROPERTY TYPE | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS | GLOBAL RANGE |
|---|---|---|---|---|---|---|---|
| security:CvssV4VulnAssessmentRelationship | |||||||
| security:score | owl:DatatypeProperty | Provides a numerical (0-10) representation of the severity of a vulnerability. | 1 | 1 | xsd:decimal sh:Literal |
xsd:decimal | |
| security:severity | owl:ObjectProperty | Specifies the CVSS qualitative severity rating of a vulnerability in relation to a piece of software. | 1 | 1 | security:CvssSeverityType sh:IRI |
sh:in
security:CvssSeverityType/critical, security:CvssSeverityType/high, security:CvssSeverityType/medium, security:CvssSeverityType/low, security:CvssSeverityType/none
|
security:CvssSeverityType |
| security:vectorString | owl:DatatypeProperty | Specifies the CVSS vector string for a vulnerability. | 1 | 1 | xsd:string sh:Literal |
xsd:string | |
| security:VulnAssessmentRelationship | |||||||
| core:suppliedBy | owl:ObjectProperty | Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element. | 0 | 1 | core:Agent sh:IRI |
core:Agent | |
rdf:type |
-- | sh:message https://spdx.org/rdf/3.0.1/terms/Security/VulnAssessmentRelationship is an abstract class and should not be instantiated directly. Instantiate a subclass instead. |
0 | * |
sh:not
sh:hasValue security:VulnAssessmentRelationship
|
-- | |
| security:assessedElement | owl:ObjectProperty | Specifies an Element contained in a piece of software where a vulnerability was found. | 0 | 1 | software:SoftwareArtifact sh:IRI |
software:SoftwareArtifact | |
| security:modifiedTime | owl:DatatypeProperty | Specifies a time when a vulnerability assessment was modified | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| security:publishedTime | owl:DatatypeProperty | Specifies the time when a vulnerability was published. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| security:withdrawnTime | owl:DatatypeProperty | Specified the time and date when a vulnerability was withdrawn. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:Relationship | |||||||
| core:completeness | owl:ObjectProperty | Provides information about the completeness of relationships. | 0 | 1 | core:RelationshipCompleteness sh:IRI |
sh:in
core:RelationshipCompleteness/incomplete, core:RelationshipCompleteness/complete, core:RelationshipCompleteness/noAssertion
|
core:RelationshipCompleteness |
| core:endTime | owl:DatatypeProperty | Specifies the time from which an element is no longer applicable / valid. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:from | owl:ObjectProperty | References the Element on the left-hand side of a relationship. | 1 | 1 | core:Element sh:IRI |
core:Element | |
| core:relationshipType | owl:ObjectProperty | Information about the relationship between two Elements. | 1 | 1 | core:RelationshipType sh:IRI |
sh:in
core:RelationshipType/affects, core:RelationshipType/amendedBy, core:RelationshipType/ancestorOf, core:RelationshipType/availableFrom, core:RelationshipType/configures, core:RelationshipType/contains, core:RelationshipType/coordinatedBy, core:RelationshipType/copiedTo, core:RelationshipType/delegatedTo, core:RelationshipType/dependsOn, core:RelationshipType/descendantOf, core:RelationshipType/describes, core:RelationshipType/doesNotAffect, core:RelationshipType/expandsTo, core:RelationshipType/exploitCreatedBy, core:RelationshipType/fixedBy, core:RelationshipType/fixedIn, core:RelationshipType/foundBy, core:RelationshipType/generates, core:RelationshipType/hasAddedFile, core:RelationshipType/hasAssessmentFor, core:RelationshipType/hasAssociatedVulnerability, core:RelationshipType/hasConcludedLicense, core:RelationshipType/hasDataFile, core:RelationshipType/hasDeclaredLicense, core:RelationshipType/hasDeletedFile, core:RelationshipType/hasDependencyManifest, core:RelationshipType/hasDistributionArtifact, core:RelationshipType/hasDocumentation, core:RelationshipType/hasDynamicLink, core:RelationshipType/hasEvidence, core:RelationshipType/hasExample, core:RelationshipType/hasHost, core:RelationshipType/hasInput, core:RelationshipType/hasMetadata, core:RelationshipType/hasOptionalComponent, core:RelationshipType/hasOptionalDependency, core:RelationshipType/hasOutput, core:RelationshipType/hasPrerequisite, core:RelationshipType/hasProvidedDependency, core:RelationshipType/hasRequirement, core:RelationshipType/hasSpecification, core:RelationshipType/hasStaticLink, core:RelationshipType/hasTest, core:RelationshipType/hasTestCase, core:RelationshipType/hasVariant, core:RelationshipType/invokedBy, core:RelationshipType/modifiedBy, core:RelationshipType/other, core:RelationshipType/packagedBy, core:RelationshipType/patchedBy, core:RelationshipType/publishedBy, core:RelationshipType/reportedBy, core:RelationshipType/republishedBy, core:RelationshipType/serializedInArtifact, core:RelationshipType/testedOn, core:RelationshipType/trainedOn, core:RelationshipType/underInvestigationFor, core:RelationshipType/usesTool
|
core:RelationshipType |
| core:startTime | owl:DatatypeProperty | Specifies the time from which an element is applicable / valid. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:to | owl:ObjectProperty | References an Element on the right-hand side of a relationship. | 1 | * | core:Element sh:IRI |
core:Element | |
| core:Element | |||||||
| core:comment | owl:DatatypeProperty | Provide consumers with comments by the creator of the Element about the Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:creationInfo | owl:ObjectProperty | Provides information about the creation of the Element. | 1 | 1 | core:CreationInfo sh:BlankNodeOrIRI |
core:CreationInfo | |
| core:description | owl:DatatypeProperty | Provides a detailed description of the Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:extension | owl:ObjectProperty | Specifies an Extension characterization of some aspect of an Element. sh:message Class is known to not derive from Extension and cannot be used |
0 | * | sh:BlankNodeOrIRI |
sh:not
sh:or (security:SsvcVulnAssessmentRelationship, security:CvssV2VulnAssessmentRelationship, security:ExploitCatalogVulnAssessmentRelationship, security:CvssV4VulnAssessmentRelationship, security:VexAffectedVulnAssessmentRelationship, security:VexNotAffectedVulnAssessmentRelationship, security:CvssV3VulnAssessmentRelationship, security:Vulnerability, security:VexUnderInvestigationVulnAssessmentRelationship, security:EpssVulnAssessmentRelationship, security:VexFixedVulnAssessmentRelationship, core:NamespaceMap, core:LifecycleScopedRelationship, core:Hash, core:Agent, core:CreationInfo, core:ExternalRef, core:Bom, core:IndividualElement, core:Relationship, core:PositiveIntegerRange, core:DictionaryEntry, core:ExternalMap, core:Annotation, core:SpdxDocument, core:Person, core:Organization, core:Bundle, core:Tool, core:ExternalIdentifier, core:SoftwareAgent, core:PackageVerificationCode, ai:AIPackage, ai:EnergyConsumptionDescription, ai:EnergyConsumption, build:Build, dataset:DatasetPackage, expandedlicensing:CustomLicense, expandedlicensing:OrLaterOperator, expandedlicensing:ListedLicense, expandedlicensing:DisjunctiveLicenseSet, expandedlicensing:ListedLicenseException, expandedlicensing:WithAdditionOperator, expandedlicensing:IndividualLicensingInfo, expandedlicensing:CustomLicenseAddition, expandedlicensing:ConjunctiveLicenseSet, simplelicensing:LicenseExpression, simplelicensing:SimpleLicensingText, extension:CdxPropertyEntry, software:Package, software:File, software:Sbom, software:Snippet, software:ContentIdentifier)
|
extension:Extension |
| core:externalIdentifier | owl:ObjectProperty | Provides a reference to a resource outside the scope of SPDX-3.0 content that uniquely identifies an Element. | 0 | * | core:ExternalIdentifier sh:BlankNodeOrIRI |
core:ExternalIdentifier | |
| core:externalRef | owl:ObjectProperty | Points to a resource outside the scope of the SPDX-3.0 content that provides additional characteristics of an Element. | 0 | * | core:ExternalRef sh:BlankNodeOrIRI |
core:ExternalRef | |
| core:name | owl:DatatypeProperty | Identifies the name of an Element as designated by the creator. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:summary | owl:DatatypeProperty | A short description of an Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:verifiedUsing | owl:ObjectProperty | Provides an IntegrityMethod with which the integrity of an Element can be asserted. | 0 | * | core:IntegrityMethod sh:BlankNodeOrIRI |
core:IntegrityMethod | |
rdf:type |
-- | sh:message https://spdx.org/rdf/3.0.1/terms/Core/Element is an abstract class and should not be instantiated directly. Instantiate a subclass instead. |
0 | * |
sh:not
sh:hasValue core:Element
|
-- | |
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix security: <https://spdx.org/rdf/3.0.1/terms/Security/> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
security:CvssV4VulnAssessmentRelationship a owl:Class,
sh:NodeShape ;
rdfs:comment "Provides a CVSS version 4 assessment for a vulnerability."@en ;
rdfs:subClassOf security:VulnAssessmentRelationship ;
sh:nodeKind sh:IRI ;
sh:property [ sh:class security:CvssSeverityType ;
sh:in ( <https://spdx.org/rdf/3.0.1/terms/Security/CvssSeverityType/critical> <https://spdx.org/rdf/3.0.1/terms/Security/CvssSeverityType/high> <https://spdx.org/rdf/3.0.1/terms/Security/CvssSeverityType/medium> <https://spdx.org/rdf/3.0.1/terms/Security/CvssSeverityType/low> <https://spdx.org/rdf/3.0.1/terms/Security/CvssSeverityType/none> ) ;
sh:maxCount 1 ;
sh:minCount 1 ;
sh:nodeKind sh:IRI ;
sh:path security:severity ],
[ sh:datatype xsd:string ;
sh:maxCount 1 ;
sh:minCount 1 ;
sh:nodeKind sh:Literal ;
sh:path security:vectorString ],
[ sh:datatype xsd:decimal ;
sh:maxCount 1 ;
sh:minCount 1 ;
sh:nodeKind sh:Literal ;
sh:path security:score ] .