Skip to content

Commit f395ebb

Browse files
committed
Improve readability
1 parent f499321 commit f395ebb

6 files changed

Lines changed: 27 additions & 3 deletions

File tree

trainingportal/static/lessons/cvss/cvss_3_score_1.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22

33
Score the following scenario using the CVSS v4.0 calculator [https://www.first.org/cvss/calculator/4-0](https://www.first.org/cvss/calculator/4-0).
44

5+
<br><br>
6+
57
### Scenario
68

7-
Unauthenticated attacker can list registered users of a SaaS offering.
9+
Unauthenticated attacker can list registered users of a SaaS offering.
10+
11+
<br><br>

trainingportal/static/lessons/cvss/cvss_3_score_1.sol.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ High-level analysis:
77

88
---
99

10+
CVSS:
11+
1012
- Attack Vector (AV): Network (N)
1113
- Attack Complexity (AC): Low (L)
1214
- Attack Requirements (AT): None (N)

trainingportal/static/lessons/cvss/cvss_4_score_2.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22

33
Score the following scenario using the CVSS v4.0 calculator [https://www.first.org/cvss/calculator/4-0](https://www.first.org/cvss/calculator/4-0).
44

5+
<br><br>
6+
57
### Scenario
68

7-
A malicious SaaS user with knowledge of another user’s unique 128-bit userid, can read all the information (e.g. details, activity, messages) for that user through an Authorization bypass in the API.
9+
A malicious SaaS user with knowledge of another user’s unique 128-bit userid, can read all the information (e.g. details, activity, messages) for that user through an Authorization bypass in the API.
10+
11+
<br><br>

trainingportal/static/lessons/cvss/cvss_4_score_2.sol.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ High-level analysis:
88

99
---
1010

11+
CVSS:
12+
1113
- Attack Vector (AV): Network (N)
1214
- Attack Complexity (AC): High (H)
1315
- Attack Requirements (AT): None (N)

trainingportal/static/lessons/cvss/cvss_5_chain.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,30 @@ Vulnerability chaining is covered in the [CVSS User Guide](https://www.first.org
99

1010
Score the following scenario using the CVSS v4.0 calculator [https://www.first.org/cvss/calculator/4-0](https://www.first.org/cvss/calculator/4-0).
1111

12+
<br><br>
13+
1214
### Scenario
1315

1416
This attack scenario consists of the 2 vulnerabilties we saw earlier. Imagine that an attacker is aware and has the ability to execute both of them as necessary to perform an attack.
1517

1618
You can leverage the CVSS vectors of the previous 2 vulnerabilities that we scored.
1719

20+
<br><br>
21+
1822
#### Vulnerability 1
1923

2024
Unauthenticated attacker can list registered users of a SaaS offering (username and userid).
2125

26+
<br><br>
27+
2228
#### Vulnerability 2
2329

2430
A malicious SaaS user with knowledge of another user’s unique 128-bit userid, can read all the information (e.g. details, activity, messages) for that user through an Authorization bypass in the API.
2531

32+
<br><br>
33+
2634
#### Impact
2735

28-
The attacker is now able to read the information for all users.
36+
The attacker is now able to read the information for all users.
37+
38+
<br><br>

trainingportal/static/lessons/cvss/cvss_5_chain.sol.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ High-level analysis:
88

99
---
1010

11+
CVSS:
12+
1113
- Attack Vector: Network (N)
1214
- Attack Complexity: Low (L)
1315
- Attack Requirements: None (N)

0 commit comments

Comments
 (0)