The Common Vulnerability Scoring System (CVSS) allows, among other things, to quantify the severity of software vulnerabilities.

What is the functional relationship between a CVSS and the associated risk? In other words, what would be the shape of the function risk(CVSS)=...?

I am asking this because I would like to have a "cumulated insecurity level" of a host, to distinguish between, for instance, a host with five CVSS=2 vulns and the one with two CVSS=10. The function above would help to set a weight for each CVSS, so that the cases in the example above are not equivalent (which would be the case of the function was linear -- which I feel it is not the case, it should be rather exponential to highlight the worst cases).

  • Just to chip in 2 cents, I find this to be difficult and subjective subject. I like the website "cve details" and here is a random one: cvedetails.com/cve/CVE-2014-4480 They list multiple aspects of the exploit including how likely it's success is and how much skill/work is required to exploit it. In general, Vulns above a 7 have remote exploit ability, and anything below a 4 is used a part of a pivot/exploit chain and is only dangerous in very specific uses. Just my 2 cents. – bashCypher Mar 20 '18 at 2:18
  • By risk, do you mean annualised loss expectancy? – paj28 Aug 12 '19 at 8:15

The methodology used by OpenVAS security scanner to give a global CVSS score to a host is to take the highest CVSS score in all vulnerabilities discovered. This means a host with five CVSS=2 will have a final CVSS score of 2 for OpenVAS, and the other one with two CVSS=10 will have a final CVSS score of 10.

Strictly speaking of the function risk(CVSS)=..., on my opinion I would say it would be close to exponential.

Let's imagine someone scanning a whole range of random IP addresses for vulnerabilities to exploit to constitute his botnet. He will only focus on high CVSS, not to spend much time on each host.

Now imagine someone scanning 2 of your public IP addresses to target you specifically. If he discovers one has a potential vulnerability with a CVSS of 10 and the other one only CVSS of 2, he will try to compromise the weakest one, not spending much time on the other one.

Moreover, CVSS 2 vulnerabilities does not allow someone to take full control of your server, so they will probably be used only by a determined attacker needing to gather information about your systems.

| improve this answer | |
  • Thanks. i) I know about the implications of CVSS (your three last paragraphs). My point is to look at a cumulative rating to have a global rating taking into account all vulns and their level, ii) the exponential part is a gut feeling (per my question), I was looking for some harder facts (if they exist) – WoJ Jul 31 '15 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.