1

Will happy for 2 clarifications regarding CVSS:

1) What is better for the references? CVSSv2 or CVSSv3? V3 is new, but V2 is mature.

2) Why there are differences in CVSS scores between NVD NIST repository and Red Hat repository?

For example:

https://access.redhat.com/security/cve/cve-2016-7167 CVSS v2: 4.3

https://nvd.nist.gov/vuln/detail/CVE-2016-7167 CVSS v2: 7.5

2

The scores are different, bcs this vulnerability is differently understood. In case of RedHat, they suggest that the vulnerability can be used to only crash the application. In case of NVD, the vulnerability can be used to execute arbitrary code.

According to vendor’s advisory https://curl.haxx.se/docs/adv_20160914.html NVD was wrong to assume RCE. The vulnerability cannot be used to execute arbitrary code, only DoS.

As for CVSSv2 and v3 - there is no such thing as mature scoring system. CVSSv3 was introduced to eliminate “inconsistencies”, caused by CVSSv2 scoring and it had partial success. Both scoring systems are far from perfect (my opinion).

| improve this answer | |
  • Ok, so what repository to use to realize the correct score? the vendor repository? – Michael Sep 7 '17 at 6:25
  • I cannot answer your question, because we are people and people make mistakes. Vendors usually do not post CVSS scores and even if they do, they make mistakes. Why do you need these scores? – Valery Marchuk Sep 7 '17 at 7:36
  • @ValeryMarchuk One usage is to classify an issue as llow/moderate/high priority. For instance, RCE or Remote denial of service should be fixed in two days.. or all issues with CVSS score higher than 7.0, should be applied immediately..and so on – VP. Feb 17 '18 at 19:14
3

CVSS is a scoring system, it is subjective and is open to interpretation by the person scoring the vulnerability, if you look at the two scores you'll see that one rates high confidentiality impact and one rates none.

On which one to use, there is no real right answer here, it's what's right for you. In my organisation we use version 3, this guide from Acunetix might help you make up your mind. Acunetix CVSS version guide

| improve this answer | |
0

CVSSv3 introduces changes in the scoring system that reflect more accurately vulnerabilities on Web applications and virtualized environments (i.e guest escape)

While all three metric groups, the Base Score, the Temporal Score and the Environmental Score remained the same, new metrics such as Scope (S) and User Interaction (UI) were added including old metrics such as Authentication (Au) being changed to newer ones such as Privileges Required (PR).

The Environmental Metrics group got a new addition with the Modified Base Metrics, allowing us to customize the CVSS scores based on the host that has been affected, making it contextual if so required.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.