The tag has no usage guidance.

learn more… | top users | synonyms

3
votes
2answers
61 views

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)? As well as converting ...
3
votes
0answers
36 views

CVSS Remediation Level for Git Commit

What do you select as remediation level if only a Git commit is available? A very common scenario for this are vulnerabilities in the Linux kernel, before a fix becomes part of the stable branch it'...
1
vote
1answer
31 views

Difference between local and physical attack vector in CVSS version 3?

In CVSS version 3, there are four different attack vectors. I am not able to differentiate between local and physical. Say, if I want to report "absence of logout button" I will use physical as ...
0
votes
1answer
20 views

What is the proper way to understand Access Complexity in CVSS

I have read Access Complexity from NVD(https://nvd.nist.gov/CVSS/v2-calculator), [Access Complexity] This metric measures the complexity of the attack required to exploit the vulnerability once ...
4
votes
1answer
64 views

Does CVSS v3 evaluate the impact of vulnerability on the host?

Recently after checking out the Heartbleed vulnerability I was taking a look at its CVSS score (AV:N/AC:L/Au:N/C:P/I:N/A:N) and noticed the following (partial) addendum: CVSS V2 scoring evaluates ...
-1
votes
1answer
34 views

Formal functional relationship between risk and CVSS

The Common Vulnerability Scoring System (CVSS) allows, among other things, to quantify the severity of software vulnerabilities. What is the functional relationship between a CVSS and the associated ...
4
votes
1answer
135 views

Why is logjam rated as “None” for confidentiality impact in CVSS?

The CVSS score for Logjam is (AV:N/AC:M/Au:N/C:N/I:P/A:N). As noted in that nice dynamic image interpretation, the Impact metric "Confidentiality" is described as "None" (C:N). But the ...
1
vote
1answer
1k views

Relationship between CVSS and Risk Level in Nessus output data

In a Nessus output file, does the Risk Level (e.g. Critical, High, Medium, Low, None) depend on the CVSS score? What relationship, if any, do the Risk Level and CVSS have? Thank yo
5
votes
2answers
4k views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
2
votes
1answer
951 views

how are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
2
votes
1answer
74 views

How to calculate CVSS of an attack so that it matches those in CVEs?

I have drawn an attack graph for a file-sharing application (eg. Dropbox) where a database stores details of virtual machines Eg. memory space left, etc. I've listed some possible attacks: The ...
4
votes
5answers
862 views

Vulnerability scoring systems

Our company is developing a web app that is used for e-commerce. We want to establish a more formal scoring system for any security related issues eventually reported by us or by our clients. The ...
2
votes
2answers
152 views

Does the CVSS impact score correspond to probability?

From http://nvd.nist.gov/cvsseq2.htm, I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact, 0.275 for ...
3
votes
1answer
86 views

CVSS Temporal Data

The CVSS standard has a "temporal" component that models the changing risk associated with a vulnerability over time, such as the publication of a working exploit. But NIST's NVD doesn't provide that ...