Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs.
Is it because they have a cool name and a logo, or is the CVE severity metric somewhat flawed?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
1) Cool names count. Don't discount the value of public relations.
2) Heartbleed, BEAST, CRIME, and POODLE all impacted (or could be be reached through) web servers. Web servers tend to be publicly available, widespread, and directly identified (in the minds of the press and non-technical public) as "THE INTERNET." Therefore, these issues had a wider possible impact and a higher perceived importance.
3) CVE tries to dispassionately describe how badly a vulnerability can hurt, but there is such a thing as the death of a million paper cuts. A CVE 9.5 that affects something rare and protected - say, Oracle database clusters - is never going to be as famous as a CVE of 4.2 that affects Apache.
4) The CVE itself doesn't take into account how ubiquitous a software package is throughout the world. Contrary to what I said in the comments below, there is one measure of ubiquity in the CVSS scoring; "target distribution (TD) metric measures the proportion of vulnerable systems in the environment". But "This measure is calculated subjectively, typically by affected parties" and so I believe that's not part of the NIST CVE, that's what gets adjusted by RedHat or Oracle when they release advisories based on the CVE. The bottom line is that CVE is not designed to determine how many people need to worry about an issue, but to determine exactly how worried those people should be if they own/use the impacted system
Take your pick of answers, there's some truth to all of them, as well as Xanders' commentary on the limitations of CVE.
It looks like FREAK is not going to cause a big splash despite having a cool name; it only impacts the subset of people who already don't care enough to make their web server secure. I'm actually kind of glad to see the press didn't get carried away just because it was ALL CAPS...
(Edited to add #4 with quotes from Wikipedia's CVSS page, just trying to round the comment chain up into the answer)
The process for assigning a CVE's CVSS score to a vulnerability is very prescriptive. There is little room for interpretation, or to account for impacts which the are not accounted for by the scoring formula. So, in the end some relatively major issues will end up with oddly low scores, and some relatively trivial issues will end up with excessively high scores. This is the nature of the system, and one of its limitations. Heartbleed is probably a prime example of an vulnerability that had a CVSS score that did not appropriately reflect the real world impact.
To elaborate on an example: CVSS explicitly excludes indirect or second-order effects from scoring. This is reasonably from a standardization perspective, otherwise you end up with wild speculation about how vulnerabilities might be exploited drastically driving up scores to a point where they can no longer be accurately differentiated. However, in the case of a vulnerability like Heartbleed, this means that the fact that critical data like authentication credentials, and certificate private keys were demonstrably at risk (in the real world, even, not just in a PoC) wasn't taken into account by the CVSS scoring. So, the CVE has a medium CVSS score of 5.0, and at them same time, sysadmins everywhere scrambled to patch systems and remediate any potential harm as soon as humanly possible, recognizing the vulnerability for the highly critical and time-sensitive risk it actually was.
Regarding why some issues become famous...Well, because they catch the public's attention. Fame is capricious and fleeting, and time spent worrying about it is time wasted.