I'm interested in CVSS v3 but I don't have enough knowledge about security or vulnerabilities.

I read the CVSS v3 user guide but I'm so confused and do not understand what they mean by:

  • scope
  • vulnerable component
  • impact component

Please help.

closed as too broad by S.L. Barth, WhiteWinterWolf, Anders, techraf, Stephane Oct 7 '16 at 7:09

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This looks like a task someone asked you to do. Nevertheless, this is to broad and does not show any effort. Which part of the document (which you can describe to show effort) is confusing? There's the network stuff, the authentication stuff, the procedural stuff in CVSS. That isn't a small piece of text, and each part has considerably different applications. – grochmal Oct 6 '16 at 13:52

The easiest way to use CVSS is to use a calculator tool like FIRST's - notice that there are 3 components, the Base, the Temporal, and the Environmental. Many companies only use the Base - I recommend that for starting out at least.

The spec has very detailed information on each component, but to paraphrase for the ones you are concerned about :

Scope : This is whether the component allows scope to change - that is, whether it allows breaking out of a sandbox or similarly restricted environment or change to a different privilege scheme. For example, if a user was able to get an api key that is intended for server-server communication, that would be a scope change (in my opinion, at least - CVSS scores have a certain level of subjectivity to them)

The Vulnerable Component is the part of the software/system that is vulnerable to the exploit. It may expose other pieces of the system, but this is the exploit's path in.

An Impact Component would be any pieces of the system that are exposed/made vulnerable by the exploit of the Vulnerable Component.

Not the answer you're looking for? Browse other questions tagged or ask your own question.