Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In the different NVD files which enumerates the CVE, which can be found here
There is from time to time the field <vuln:security-protection>
, containing often the value ALLOWS_OTHER_ACCESS or ALLOWS_ADMIN_ACCESS.
Do you know what this field stand for ? What does it means ?
This FAQ about assigning vulnerability types implies that <vuln:security-protection> indicates that a vulnerability can be leveraged to gain access to a system.
Access is the holy grail when trying to compromise a system since if you have access you can then compromise the system in any other way you want (availability, integrity, confidentiality).
The presence of the <vuln:security-protection> element indicates that the vulnerability impacts on access rights while the value (ALLOWS_ADMIN_ACCESS etc.) indicates the level of impact.
