Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: a5a9971a30efec90406129f8b2de8e78a5f05a60 https://github.com/xwiki/xwiki-dev-llm/commit/a5a9971a30efec90406129f8b2de8e... Author: Simon Urli <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Clarify how to score CVSS impacts for gained rights and preconditions * A right the attack yields never caps the impacts: only a right it needs does. * Score impacts from what the attacker can achieve, not from what a PoC printed. * Check the usual wiki access setups before calling an Attack Requirement rare. * Drop a sentence restating that per-metric values are not cached. Co-Authored-By: Claude Opus 5.5 <[email protected]> Commit: b5e78b6137a74b6aa34917972da610cd8b27733e https://github.com/xwiki/xwiki-dev-llm/commit/b5e78b6137a74b6aa34917972da610... Author: Vincent Massol <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Tighten the CVSS impact and Attack Requirements traps * Keep the right cap bullet to the cap; state the 'score by reach' rule once, in the achievable-impact bullet. * Phrase the access-setup check in CVSS terms (setting Attack Requirements to Present) and give it its own bullet, out of the 'no XWiki best practice' one. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Commit: dc31a70418839b13d567241d41267e8435129476 https://github.com/xwiki/xwiki-dev-llm/commit/dc31a70418839b13d567241d41267e... Author: Vincent Massol <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Add the Attack Complexity trap to the CVSS scoring traps * Attack Complexity is a protection to defeat, never the privilege the attacker holds, which Privileges Required already encodes. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Commit: 43ecf7f95f116bc3612d1205900c3010cc6e3f79 https://github.com/xwiki/xwiki-dev-llm/commit/43ecf7f95f116bc3612d1205900c30... Author: Vincent Massol <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- Merge pull request #236 from xwiki/cvss-impact-review-fixes [Misc] Tighten the CVSS impact and Attack Requirements traps Commit: 533a556979d0e66818580dd43a28b9f78e62d44a https://github.com/xwiki/xwiki-dev-llm/commit/533a556979d0e66818580dd43a28b9... Author: Vincent Massol <[email protected]> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- Merge pull request #235 from xwiki/cvss-impact-from-achievable [Misc] Clarify how to score CVSS impacts for gained rights and preconditions Compare: https://github.com/xwiki/xwiki-dev-llm/compare/b1cfcbc91c35...533a556979d0 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications