Skip to content

CVSS.md

Latest commit

 

History

History
28 lines (13 loc) · 2.87 KB

CVSS.md

File metadata and controls

28 lines (13 loc) · 2.87 KB
Raw

Common Vulnerability Scoring System (CVSS)

The Common Vulnerability Scoring System (CVSS) is a framework used to assess and communicate the severity of security vulnerabilities in software systems. It provides a standardized method for evaluating vulnerabilities, allowing security professionals to prioritize their response efforts effectively. CVSS scores help organizations understand the potential impact of a vulnerability and make informed decisions about how to mitigate it.

Here's a breakdown of the key components of the CVSS

  • Base Score: The base score represents the intrinsic qualities of a vulnerability and is calculated using several metrics:

    • Attack Vector (AV): This metric describes how an attacker can exploit the vulnerability. For example, is physical access required, or can it be exploited remotely over a network?

    • Attack Complexity (AC): This metric considers how complex the attack is to execute. Is it straightforward or requires significant resources or conditions?

    • Privileges Required (PR): This metric indicates the level of privileges an attacker needs to exploit the vulnerability. Does the attacker require elevated privileges, or can it be exploited with minimal access?

    • User Interaction (UI): This metric assesses whether the vulnerability can be exploited without user interaction. Does the attacker need to trick the user into performing an action, or can it be exploited silently?

    • Scope (S): This metric determines whether the vulnerability impacts the system where it's located or can affect other systems. Is the vulnerability confined to the vulnerable component, or can it extend to other parts of the system?

  • Temporal Score: The temporal score reflects the characteristics of a vulnerability that may change over time. It includes metrics like exploit code maturity, remediation level, and report confidence. These factors can influence the urgency of patching or mitigating the vulnerability.

  • Environmental Score: The environmental score allows organizations to customize the CVSS score based on their specific deployment environment. Factors such as the importance of the affected asset, the sensitivity of the data it handles, and the security controls in place can all affect the overall risk posed by the vulnerability.

The CVSS score is represented as a numeric value between 0.0 and 10.0, with higher scores indicating more severe vulnerabilities. Organizations can use these scores to prioritize their response efforts, focusing on vulnerabilities with the highest potential impact on their systems.

It's important to note that while CVSS provides a valuable framework for assessing vulnerabilities, it's just one tool in the broader cybersecurity toolbox. Organizations should consider other factors, such as threat intelligence, asset criticality, and business impact, when making decisions about vulnerability management and remediation.