fix(reports): render CVSSv4 baseScore = 0.0 in JSON+XML reports

[chadlwilson]

Description of Change

Fixes JSON and XML reports to always include CVSS v4.0 baseScore, similar to that for CVSSv2 and CVSSv3.

DependencyCheck/core/src/main/resources/templates/jsonReport.vsl

Lines 208 to 210 in 19a45fc

	"cvssv2": {
	"score": $vuln.cvssV2.cvssData.baseScore
	,"accessVector": "$enc.json($vuln.cvssV2.cvssData.accessVector)"

DependencyCheck/core/src/main/resources/templates/jsonReport.vsl

Lines 228 to 230 in 19a45fc

	"cvssv3": {
	"baseScore": $vuln.cvssV3.cvssData.baseScore
	,"attackVector": "$enc.json($vuln.cvssV3.cvssData.attackVector)"

The model object defines baseScore as non-null/required (despite being a boxed Double) and most other reports assume it is, so should be safe. The DB technically allows it to be null, but many other places assume it is not.

The current check is problematic as Velocity treats 0 as "false" in the check, which omits 0 scores (SeverityType = NONE) which is incorrect.

Seems safe and simplest to remove the check rather than contort Velocity to do an "is non-null" check. Note that there are many other places where the baseScore is taken directly within the #if emptiness check, so suspect this was just generated/propagated across all fields in the data naively. It's already assumed to be there in the HTML and SARIF reports, for example.

DependencyCheck/core/src/main/resources/templates/htmlReport.vsl

Line 843 in ff1a367

#set($cveImpact=$severestVuln.cvssV4.cvssData.baseScore)

DependencyCheck/core/src/main/resources/templates/htmlReport.vsl

Lines 1037 to 1041 in ff1a367

	#if($vuln.getCvssV4())
	CVSSv4:
	<ul><li>Base Score: $enc.html($vuln.getCvssV4().getCvssData().getBaseSeverity()) ($vuln.getCvssV4().getCvssData().getBaseScore())</li>
	<li>Vector: $enc.html($vuln.getCvssV4().toString())</li></ul>
	#end

Related issues

• fixes Missing default CVSSv4 baseScore when vulnerability is not yet scored #8662

Have test cases been added to cover the new functionality?

no