-2

I am using CVSS 3.1 and even though I read the documentation I still doubting with numerous findings. For example:

  1. Internet facing hostname is missing CAA and SPF DNS record. What would PR be? I suppose you need high privileges in order to create a new certificate (missing CAA record), so PR:H? What about CIA?
  2. Internet facing web server discloses server version number in HTTP header. This seems pretty simple - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Would this be correct? 5.3 score does seem pretty high for such a innocent finding.
  3. SQL Server configuration has "CRL enabled = 1". Does CVSS even apply to such configuration related findings?
  4. FTP server is accessible from the Internet on port 21. Can CVSS be used for this? How would it look?
Improve this question
7
  • 1
    I think you need to read the documentation about what CVSS is for: first.org/cvss/v4.0/faq
    – schroeder ♦
    Commented Nov 9, 2023 at 23:33
  • @schroeder, I read your link, which part exactly are you referring to? I realize it's vulnerability scoring system and technically some of these are not vulnerabilities, but then even market leading companies often define CVSS for various misconfiguration issues. For example here, CVSS 5.3 score is set for SMB signing enabled: tenable.com/plugins/nessus/57608.
    – user1880405
    Commented Nov 10, 2023 at 8:42
  • That's not the support for your position that you think it is. How does the lack of SPF result in an attack against the server? As an exercise, write up how you would describe each of these in the format of that Nessus plugin.
    – schroeder ♦
    Commented Nov 10, 2023 at 8:59
  • First line: "The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities." You've expanded the scope of the scoring system to vulnerabilities to the org itself beyond the software.
    – schroeder ♦
    Commented Nov 10, 2023 at 9:00
  • Fair enough. But then as per my link Tenable also does not define this correctly with their SMB CVSS score?
    – user1880405
    Commented Nov 10, 2023 at 9:18

1 Answer 1

Reset to default
3

To me it seems that you struggle with defining what's a vulnerability and what's a feature.

Does reporting versions make a vulnerability? I would argue no; it's not intended to be secret, so why bother? If you're running latest and greatest it should reveal nothing; if 0-days are known, they will work against you anyway, so an attacker doesn't really gain a huge edge. If you run really outdated stuff, the problem isn't that an attacker knows that you do; it's the fact that you do that's your problem.

Same goes for things like CRL and FTP servers. If you need CRL support in SQL Server, it's a feature, not a vulnerability. If you don't need it, it extends the attack surface, and should probably be disabled. Same for FTP - if I'm aware that I'm running an FTP server, and it serves stuff I want to be public, then it doesn't compromise anything. It's an desired service.

Improve this answer
7
  • I guess my confusion arises that everyone seems to be using this differently. For example here Tenable defines CVSS 5.3 score for SMB signing disabled - tenable.com/plugins/nessus/57608. This is not vulnerability just like DNS config, correct?
    – user1880405
    Commented Nov 10, 2023 at 8:40
  • So how do i decide what can be rated using CVSS and what not? It sounds like most findings related to weak configuration then shouldn't have CVSS score assigned or not the case?
    – user1880405
    Commented Nov 12, 2023 at 20:52
  • What Schroeder wrote: First line: "The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities." You've expanded the scope of the scoring system to vulnerabilities to the org itself beyond the software.
    – vidarlo
    Commented Nov 12, 2023 at 20:54
  • If it is not a vulnerability, it doesn't make sense to score it. A FTP server you're aware of is not a vulnerability. It's a feature.
    – vidarlo
    Commented Nov 12, 2023 at 20:55
  • Ok, so for example: It makes sense to set CVSS for SSL 3.0 because it's vulnerable to BEAST, but it does not make sense to set CVSS for RC4 because it's a weak cipher but no per se a vulnerability? Likewise it does not make sense to set CVSS for insecure RDP or SMB configuration because it's just a config issue? Even though it clearly posses a risk. What about detailed error message being disclosed? That sounds like a feature, on the other than i can easily see how can that be defined a vulnerability if it's not intended to be shown.
    – user1880405
    Commented Nov 12, 2023 at 21:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .