Skip to content

Commit dcce949

Browse files
martindgmartindg
committed
CVSS case studies
1 parent 818d938 commit dcce949

3 files changed

Lines changed: 146 additions & 0 deletions

File tree

‎trainingportal/static/lessons/cvss/cvss_case_studies.md‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
## [CVE-2025-4427](https://nvd.nist.gov/vuln/detail/CVE-2025-4427)
2+
3+
### Description
4+
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
5+
6+
### CVSS Score
7+
8+
**NOTE:** The official NVD entry for this vulnerability contains 2 separate CVSS scores: one provided by the vendor and one provided by the National Vulnerability Database (NVD). The discrepancy here is in the impact metric for `Confidentiality`. The vendor claims `Low` impact, while the NVD claims `High` impact. This example demonstrates how even the technical aspects alone can be subject to interpretation and discussion.
9+
10+
#### Vulnerability Dissection
11+
12+
Looking at the description, we can inform some of the CVSS metrics:
13+
14+
- `authentication bypass in the API` and `without proper credentials`
15+
- Attack Vector: Network (`AV:N`) *(assuming a Web API)*
16+
- Privileges Required: None (`PR:N`)
17+
- `access protected resources`
18+
- Confidentiality: High (`VC:H`)
19+
20+
The rest we can keep with the CVSS defaults i.e. no exploitability requirements and no impact.
21+
22+
#### CVE Official CVSS v3.1 Score
23+
NVD: 7.5 High [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
24+
25+
#### Proposed CVSS v4.0 Score
26+
27+
8.7 High [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
28+
29+
<br><br>
30+
31+
---
32+
33+
## [CVE-2020-4004](https://nvd.nist.gov/vuln/detail/CVE-2020-4004)
34+
35+
### Description
36+
37+
VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
38+
39+
### CVSS Score
40+
41+
#### Vulnerability Dissection
42+
43+
Looking at the description, we can inform some of the CVSS metrics:
44+
45+
- `local administrative privileges`
46+
- Attack Vector: Local (`AV:L`)
47+
- Privileges Required: High (`PR:H`)
48+
- `on a virtual machine` and `virtual machine's VMX process running on the host`
49+
- Scope: Changed (`S:C`) in CVSS v3
50+
- Subsequent System impact in CVSS v4
51+
- `VMX process`
52+
- The VMX process is a privileged process on the host, so all impact is High (`VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`)
53+
54+
#### CVE Official CVSS v3.1 Score
55+
NVD: 8.2 High [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
56+
57+
#### Proposed CVSS v4.0 Score
58+
9.3 Critical [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
59+
60+
<br><br>
61+
62+
---
63+
64+
## [CVE-2025-40591](https://nvd.nist.gov/vuln/detail/CVE-2025-40591)
65+
66+
### Description
67+
68+
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5) ... . The 'Log Viewers' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute the 'tail' command with root privileges and disclose contents of all files in the filesystem.
69+
70+
### CVSS Score
71+
72+
#### Vulnerability Dissection
73+
74+
Looking at the description, we can inform some of the CVSS metrics:
75+
76+
- `authenticated remote attacker`
77+
- Attack Vector: Network (`AV:N`)
78+
- Privileges Required: Low (`PR:L`)
79+
- `disclose contents of all files`
80+
- Confidentiality: High (`C:H`)
81+
- **Note**: Apart from the files of the application itself, an attacker can also read all files on the host. Hence, we have change of scope from the vulnerable system (the web application) with its own Authentication and Authorization (i.e. security scope) to the subsequent system (the host itself).
82+
83+
#### CVE Official CVSS v4.0 Score
84+
Siemens AG: 8.3 High [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N)
85+
86+
<br><br>
87+
88+
---
89+
90+
## [CVE-2025-34124](https://nvd.nist.gov/vuln/detail/CVE-2025-34124)
91+
92+
### Description
93+
94+
A buffer overflow vulnerability exists in Heroes of Might and Magic III Complete 4.0.0.0, HD Mod 3.808 build 9, and Demo 1.0.0.0 via malicious .h3m map files that exploit object sprite name parsing logic. The vulnerability occurs during in-game map loading when a crafted object name causes a buffer overflow, potentially allowing arbitrary code execution. Exploitation requires the victim to open a malicious map file within the game.
95+
96+
### CVSS Score
97+
98+
#### Vulnerability Dissection
99+
100+
Looking at the description, we can inform some of the CVSS metrics:
101+
102+
- `via malicious .h3m map files`
103+
- Attack Vector: Local (`AV:L`)
104+
- `Exploitation requires the victim to open a malicious map file within the game`
105+
- User Interaction: Active (`UI:A`)
106+
- `arbitrary code execution`
107+
- Confidentiality: High (`VC:H`)
108+
- Integrity: High (`VI:H`)
109+
- Availability: High (`VA:H`)
110+
111+
#### CVE Official CVSS v4.0 Score
112+
113+
VulnCheck: 8.4 High [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

‎trainingportal/static/lessons/cvss/cvss_case_studies.sol.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
The [User Interaction (UI)](https://www.first.org/cvss/v4-0/specification-document#User-Interaction-UI) metric covers "the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system".

‎trainingportal/static/lessons/cvss/definitions.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,38 @@
2626
],
2727
"answer":"1",
2828
"codeBlockIds":[]
29+
},
30+
{
31+
"id":"cvss_case_studies",
32+
"name":"Case Studies",
33+
"description": "cvss_case_studies.md",
34+
"solution": "cvss_case_studies.sol.md",
35+
"type":"quiz",
36+
"mission":"Which CVSS metric covers the following exploitation prerequisite: \"Attacker needs to trick a victim into ...\"",
37+
"options":[
38+
{
39+
"display": "Attack Vector (AV)",
40+
"value":"1"
41+
},
42+
{
43+
"display":"Attack Complexity (AC)",
44+
"value":"2"
45+
},
46+
{
47+
"display":"Attack Requirements (AT)",
48+
"value":"3"
49+
},
50+
{
51+
"display":"Privileges Required (PR)",
52+
"value":"4"
53+
},
54+
{
55+
"display":"User Interaction (UI)",
56+
"value":"5"
57+
}
58+
],
59+
"answer":"5",
60+
"codeBlockIds":[]
2961
}
3062
]
3163
}

0 commit comments

Comments
 (0)