0

I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have searched for using the NVD API.

Although these metrics exist in the CVSS schema (https://csrc.nist.gov/schema/nvd/api/2.0/external/cvss-v3.1.json), they do not appear in the API response. Instead, they are all set to "not defined" when I look for a CVE and check the calculation example:

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-0002

I also have a local copy of the NIST database, but none of the CVEs in it have those metrics.

My question is: Does NIST provide information about these values? Are they supposed to be available through the NVD API or any other source?

Any insights, explanations, or suggestions on how to deal with this problem would be greatly appreciated.

Thanks in advance!

1 Answer 1

0

It's now been 7 years I've been working with the NVD (and local replications of its database for custom querying), and I've never seen a Temporal (nor an Environmental) score.

My understanding is that though

  1. these are of course part of the CVSS specification (https://www.first.org/cvss/specification-document),
  2. and some CVE references can be tagged as 'PoC' or 'Exploit', as well as 'Mitigation' or 'Patch',
  3. and as a whole, NVD analysis on a CVE have an history and can be revised,

it's a fact that NVD analysts don't ever establish nor revise this score. Probably both by lack of reliable enough information and of resource. Especially, this would require reliable sources of threat information.

Note that there has been some progress regarding this "reliable sources of threat information" topic. Especially, since November 2021, 2 new organizations emerged. On the public sector side, the CISA KEV (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). A CVE being part of this catalog is clearly noticed as such in the NVD, for example https://nvd.nist.gov/vuln/detail/CVE-2014-0196. On the private sector, InTheWild.io (https://inthewild.io/) from crowdsourcing.

Also, note that you can have 2 different CVSS score on the NVD: one from the NVD analysts, and another one from the reporting CNA. Your example CVE-2023-0002 illustrate this with a second CVSS from Palo Alto Networks, Inc. Red Hat systematically re-score its CVSS, see https://www.redhat.com/en/blog/security-flaws-and-cvss-rescore-process-nvd. This illustrate the fact that you can score and re-score CVSS as you wish, still respecting the specification. Especially, you an only you can calculate an Environmental score: it depends of the context of the product, and its use in your organization.

On a general perspective, CVSS is one of those things that is both overdesigned and underused in the NVD (CPE is another example).

For a review of why you should take CVSS with a bit of salt, I can highly recommend this brilliant paper (long, but it worth your time): https://theoryof.predictable.software/articles/a-closer-look-at-cvss-scores/

2
  • Thank you very much for your answer and explanation. I'm currently working on a project to prioritize CVEs, and it depends on these two metrics, among other values. Is there any service / API etc that can provide them ? The paper is very good and explains many issues that I have faced (and could face in the future).
    – Tlopasha
    Commented May 18, 2023 at 20:47
  • @Tlopasha you can find CISA KEV and InTheWild API from a Google search. If you're digging into prioritization, I would recommend you have a look at EPSS, from first.org (responsible for the CVSS specification BTW): first.org/epss Like everything statistical related, read it cover to cover, with the fine prints. first.org/epss/api Last, have a look at SSVC: cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc github.com/CERTCC/SSVC
    – jbm
    Commented May 23, 2023 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .