Add CVSS vector elements as decision point docs

[ahouseholder]

• resolves Create reference documentation for CVSS vector elements as decision points #689

This pull request includes several changes to the documentation, particularly focusing on connecting CVSS vector elements and SSVC decision points and adding markdown includes for various decision points for cross-reference. The most important changes include the addition of tips explaining the interchangeability between CVSS and SSVC decision points, updates to markdown files with new content, and the inclusion of example blocks for different CVSS-based decision points.

Documentation Enhancements:

• Added tips to explain the interchangeability between CVSS and SSVC decision points in automatable_cvss_ssvc.md, safety_cvss_ssvc.md, and value_density_cvss_ssvc.md. [1] [2] [3]
• Updated automatable.md to include markdown from automatable_cvss_ssvc.md. [1] [2]
• Added new markdown files for various CVSS decision points, including attack_complexity.md, attack_requirements.md, attack_vector.md, authentication.md, availability_impact.md, availability_requirement.md, collateral_damage_potential.md, confidentiality_impact.md, confidentiality_requirement.md, exploit_maturity.md, impact_bias.md, integrity_impact.md, integrity_requirement.md, and privileges_required.md. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]
• Created an index for CVSS decision points in cvss/index.md, organizing them into groups according to the CVSS v4.0 specification document.

[sei-renae]

Why are our cvss table values not listed in the same order as on the https://www.first.org/cvss/v4.0/specification-document ?

[ahouseholder]

Merged main to catch up and resolve conflicts. Also did markdownlint to bring the new markdown up to snuff.

[ahouseholder]

Why are our cvss table values not listed in the same order as on the https://www.first.org/cvss/v4.0/specification-document ?

I was looking at the CVSS v4 spec when I did those lists, so it was my intent that they be in the same order.
I might be misunderstanding something. They seem to be in the same order to me? Both in the nav bar and in the page (left-to-right-then-top-to-bottom).

[sei-renae]

Why are our cvss table values not listed in the same order as on the https://www.first.org/cvss/v4.0/specification-document ?

I was looking at the CVSS v4 spec when I did those lists, so it was my intent that they be in the same order. I might be misunderstanding something. They seem to be in the same order to me? Both in the nav bar and in the page (left-to-right-then-top-to-bottom).

For example, in ‘Exploit Maturity,’ FIRST orders the values XAPU whereas CERTCC orders them UPAX.
This is a trend across the decision points- that we list values in opposite orders.

[ahouseholder]

For example, in ‘Exploit Maturity,’ FIRST orders the values XAPU whereas CERTCC orders them UPAX.
This is a trend across the decision points- that we list values in opposite orders.

Ah, I see what you mean. The short (and ironically apt) answer is that CVSS and SSVC have different perspectives on "endianness".

I'll pause to let you recover from the eye roll before proceeding.

...

Ready? cool.

CVSS tends to list the worst thing first, and the least bad thing last. They repeat this in CVSS v4 with the Equivalence Sets as well: 0 is the worst thing and the least bad thing is either a 1 or 2 depending on how many things are in the list. This gave me the same feeling as folks must have had when Celsius showed up with a temperature scale in which water boils at zero and freezes at 100.

We went with the idea that zero is less than one and one is less than two and therefore the zeroth item in the list should be least bad of the ordered set. (18th Century Science also reached a similar conclusion with temperature, lucky us.)

The long answer is in https://github.com/CERTCC/SSVC/blob/main/docs/adr/0008-decision-points-are-ordered-sets.md