I have a web application which is vulnerable to XXE attack. The impact of this vulnerability is, it can do a port scan by sending a malicious XML that does a request to a specific host+port in the server instance/network.

When calculating the CVSS score for this issue, I have the following concern for 'Scope' vector of the CVSS score 3.1.

When calculating the scope, CVSS Score specification says, if the resources managed by the same security authority, scope is unchanged. However, security authorities of the resources(vulnerable web application and the impacted resource that access via the XXE vulnerability) in the aforementioned issue, can be changed along with the deployment. As per my understanding, the impacted component might be managed by the same security authority or another authority depending on the server deployment.

  • In that case how should we proceed the scope value to calculate the CVSS score? What is the common practice for this kind of scenario?
  • Or else, is there anything that I have missed when understanding 'Scope' definition?

2 Answers 2


What does "Scope" mean?

The scope essentially asks whether the vulnerable component is also the affected component. Let's use a SQL injection as a simple example:

The vulnerable component is the web application. It just concatenates input into a pre-written SQL query and sends that to the database. The database is the component that is actually affected by the vulnerability. Afterall, it allows an attacker to arbitrarily read and possibly even modify data.

So to make it simple, it asks Who screwed up? and Who suffers the consequences?. If they are the same, the scope is unchanged. If they are different, the scope changes.

How does this apply to XXE?

As you said in your question, the vulnerability allows an attacker to perform a port-scan on your internal network. We can quickly see that the vulnerability lies within the web application, but the other hosts on the network are now affected as a result. This leads to the conclusion that the scope has changed.

  • Amazing explanation of one of the most confusing parts of the CVSS rating system! Oct 19, 2020 at 20:47


How I analysed it:

1) Score the impact (CIA).

2) Identify the impacted components.

3) If any of the impacted components are under a different authority, you should go with the worst case S:C.

"does a request to a specific host+port in the server instance/network. " -> An attacker could exploit the vulnerability to make requests. The vulnerable component is the web app.

Under the assumption that we cannot send the request directly, only the vunlnerable web app can send it, we gained access to the network.

TIPS: Check their examples: https://www.first.org/cvss/v3.1/examples

When reporting a vulnerability try to best describe the impact and avoid scoring CVSS unless you're 100% sure. Most of the times the vulnerability analyst that will read your report has a different implementation of the standard and will adapt it to suit their own internal rules.

If you really need to provide a CVSS score, check NVD (https://nvd.nist.gov/vuln/search) but keep in mind they go with a default score when they don't have enough details about a certain CVE.

Everyone has their own perspectives on CVSS, some don't score certain conditions, others score those, but when you have to score a generic vulnerability it's always best to score worst case possible because I would rather get an alert that proves to be not so bad, than not getting an alert for a critical vulnerability.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .