1

I'm working on a school project, which is a tool that generate security auditing reports in PDF.

I'm currently using testssl.sh which check for SSL/TLS Vulnerabilities

When a vulnerability is identified, I want to indicate to the user how much important the threat is to confidentiality and how easy it is to exploit.

I made this table a few days ago, and according to the CVSS v2 scoring system, the majority of the vulnerabilities severity are Medium, and many vulnerabilities share the same scores. I got confused on how to rate these vulnerabilities based on Impact/Exploitability and whether a vulnerability is a real threat.

enter image description here

Is there a way to classify these vulnerabilities into risk categories (i.e: Low, Medium, High) to show to the user how serious a detected vulnerability is ?

2
  • 1
    I'm not sure what your question is. You already classified the vulnerabilities? Are you just not happy with the result? CVSS is a rather rudimentary scoring system, and it doesn't work that well for all vulnerabilities. Are you asking for other system?(I'm pretty sure that that is a duplicate, but I can't find it right now)
    – tim
    Feb 21 '17 at 19:37
  • Like you said, I find the CVSS system a bit inaccurate when evaluating SSL/TLS vulnerabilities and I'm not happy about it. I was hoping to find leads here on how easy each vulnerabilities can be exploited in real life and whether a vulnerability is theoretical or require huge ressources and accordingly I can rate each one: Low, Medium or High risk
    – WinkoBit
    Feb 22 '17 at 7:59
1

First, you selected a great idea for a project. Scanning a HTTPS Site and generating a report on the vulnerabilities with the specific SSL/TLS stack is small enough to be doable and useful still.

The problem with LOW/MEDIUM/HIGH classification for these vulnerabilities is that some of them are really easy to pull off, like heartbleed, but the result is not always very useful. Again, in the case of Heartbleed, you get to read some memory, but dont control what is read. It might reveal a certificate or session ID, but will probably be more junk than anything useful. That is why it's Exploitability was rated at 10, but the impact was a low 2.9.

Sometimes you have the opposite, where a misconfiguration which is uncommon will give remote root access, but the conditions to successfully exploit it are difficult. This would give you a low exploitablity score, but a high impact

You should consider using a standard formula, to determine risk, such as the one from OWASP. Risk = Likelihood * Impact

OWASP Risk Scoring

They have a more complex model for determining severity: OWASP Severity scoring

0
0

Like you said, I find the CVSS system a bit inaccurate when evaluating SSL/TLS vulnerabilities and I'm not happy about it.

The CVSS system typically already uses this to develop the original score. If you don't like how basketball is scored, do you look for an alternative? This is the way it is, if you don't like, you can build your own, but on who's authority should some trust you over the CVSS score?

I'm not saying CVSS is right, but it is what is used and considered the standard.

I was hoping to find leads here on how easy each vulnerabilities can be exploited in real life and whether a vulnerability is theoretical or require huge ressources and accordingly I can rate each one: Low, Medium or High risk

I would suggest Googling for a specific vulnerability that peaks your interest, look for some PoC code and setup a vulnerable server. Play with it and see what/how you can make it work. This might also give you some insight on how the scoring was set for a vulnerability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.