The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [cvss]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
20
votes
5answers
4k views

Can a network vulnerability be exploited locally?

I've been looking for information about vulnerability classification and it's not completely clear to me. Reading the CVSS documentation (2.1.1. Access Vector) I observe the following explanation ...
0
votes
1answer
60 views

How to rate CVSS when PR is low but UI of admin user is required

I have a situation where an attacker with low privileges can perform an attack. However, in order to complete the attack, the system has to be restarted, which can only be done by the admin account. ...
1
vote
1answer
185 views

API to Get CVE Info [closed]

I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:...
2
votes
3answers
168 views

Do I need to worry about vulnerabilities that require administrative privileges to exploit?

I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines. What confuses me is that fact that those vulerabilities are scored with a high risk score, but require(...
1
vote
1answer
88 views

How to rate CVSS3's “Privileges Required” when an attacker can create an account?

The Common Vulnerability Scoring System Version 3.0 rates the severity of vulnerability depending on factors such as: Attack Vector (AV) - What kind of access does an attacker need? Can they do it ...
4
votes
3answers
724 views

CVSS Score for self-XSS (stored XSS)

I have a web application which is vulnerable to stored, self-XSS attack. Proper encoding is not done In the place where the data from a database (set by the same user) is added to response. However, ...
1
vote
1answer
54 views

Common practice when CVSS v2 score over represents severity

We're formalizing our vulnerability management process and decided to use CVSS V2 to help decide what vulnerabilities to remediate. We're running into a situation where a vulnerability's severity ...
1
vote
2answers
276 views

CVSS3.0 impact score and exploitability score

I'm having some trouble calculating CVSS v3.0 scores in some findings I've encountered. In particular, one finding is a simple server information disclosure via default error pages. It is very ...
1
vote
1answer
179 views

Penetration Testing of IaaS/PaaS environment - CVSS Score

How can I measure the effectiveness of a Penetration Testing carried out in a Cloud Environment (IaaS/PaaS) by a third Party Vendor ? Should I ask for a CVSS score or something else ? Any advise will ...
1
vote
1answer
119 views

Why is CVE-2017-5461 rated Critical with CVSS Score 9.8?

A while ago I came across this CVE-2017-5461, which is rated 9.8 both on NVD and Redhat Portal, with a CVSS base string of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for those who is not very ...
0
votes
2answers
173 views

Is there a CVE or CVSS for enumeration of ports?

Lets say that there is a company which does not have a firewall and it is possible to perform an enumeration of ports and services. Could it be considered a vulnerability if it provides ...
6
votes
1answer
369 views

Can any of the INTEL-SA-00086 vulnerabilities be exploited by an unprivileged user?

Several of the latest Intel Management Engine vulnerabilities are listed as local vulnerabilities, allowing code executing on the system to elevate its privileges to ME context. One of them (CVE-2017-...
1
vote
1answer
57 views

Can CVSS score be different from that calculated from vector

In most databases, there two fields: CVSS vector and CVSS score. It's logical that if we calculate score from vector, it's supposed to be equal to the score field. But, can it be manually 'tuned' and ...
1
vote
3answers
120 views

Clarification regarding CVSS

Will happy for 2 clarifications regarding CVSS: 1) What is better for the references? CVSSv2 or CVSSv3? V3 is new, but V2 is mature. 2) Why there are differences in CVSS scores between NVD NIST ...
2
votes
1answer
1k views

What does “scope” mean in CVSS v3?

In CVSS v3, the "scope" indicates whether a vulnerability in an application impacts resources beyond its means. It can have the values "changed" or "unchanged". I don't fully understand when the ...
3
votes
1answer
195 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
1
vote
1answer
224 views

CVSS score for no-input validation

During a security assesment I found that an application wrote JavaScript from input fields directly in the database. The application it self had good output sanitization so no XSS was possible in that ...
6
votes
1answer
229 views

Why does the CVSS3 score increase when the confidentiality impact decreases?

Consider these two cases: 1) Impact on Confidentiality as High 2) Impact on Confidentiality as Low Please note all other parameters are unchanged and environmental parameters are set as High. Now, ...
0
votes
1answer
394 views

Public vulnerability feed with CVSS v3

NIST NVD publishes XML feeds of CVEs but, as far as I'm concerned, only with CVSS v2 vectors. CVSS v3 results are available on web portal. Is there available any up to date, processing friendly, raw ...
2
votes
1answer
502 views

Why do CVSS scores change?

In National Vulnerability Database page (https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0778), from the change history, we can see CVSS v3 scores has been changed overtime. For example, CVE-...
26
votes
5answers
3k views

Is unauthorised deletion an integrity or availability issue?

During a web application test I have discovered a parameter tampering issue that allows a user to delete comments left by other users. They can't modify the content of other users' comments, and they ...
4
votes
1answer
301 views

Why doesn't CVSSv2 consider XSS to have a confidentiality impact?

From the CVSSv2 specification: SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...
3
votes
2answers
1k views

Why is XSS scored with partial impact to integrity in CVSS V2?

From CVSS v2 complete guide : "SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...
-1
votes
1answer
115 views

Please elaborate scope , vulnerable component , impact component in CVSS v3 [closed]

I'm interested in CVSS v3 but I don't have enough knowledge about security or vulnerabilities. I read the CVSS v3 user guide but I'm so confused and do not understand what they mean by: scope ...
3
votes
1answer
88 views

Does the ability to delete data impact availability in CVSS v2?

NIST SP 800-33 2.0.1 says that "availability" part of the CIA triad protects against intentional or accidental attempts to either: perform unauthorized deletion of data or otherwise cause a denial ...
2
votes
3answers
1k views

Deciding CVSS v3 scope parameter for a few OWASP top 10 vulnerabilities

I am trying to score owasp top 10 on cvss v3 and I am having difficulties assigning "scope" parameter for some. Please correct the below list if there are some faults. SQL Injection: Changed. ...
3
votes
2answers
4k views

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)? As well as converting ...
2
votes
1answer
91 views

CVSS Remediation Level for Git Commit

What do you select as remediation level if only a Git commit is available? A very common scenario for this are vulnerabilities in the Linux kernel, before a fix becomes part of the stable branch it'...
1
vote
1answer
2k views

Difference between local and physical attack vector in CVSS version 3?

In CVSS version 3, there are four different attack vectors. I am not able to differentiate between local and physical. Say, if I want to report "absence of logout button" I will use physical as ...
0
votes
1answer
153 views

What is the proper way to understand Access Complexity in CVSS

I have read Access Complexity from NVD(https://nvd.nist.gov/CVSS/v2-calculator), [Access Complexity] This metric measures the complexity of the attack required to exploit the vulnerability once ...
4
votes
2answers
402 views

Does CVSS v3 evaluate the impact of vulnerability on the host?

Recently after checking out the Heartbleed vulnerability I was taking a look at its CVSS score (AV:N/AC:L/Au:N/C:P/I:N/A:N) and noticed the following (partial) addendum: CVSS V2 scoring evaluates ...
1
vote
1answer
141 views

Formal functional relationship between risk and CVSS

The Common Vulnerability Scoring System (CVSS) allows, among other things, to quantify the severity of software vulnerabilities. What is the functional relationship between a CVSS and the associated ...
4
votes
1answer
235 views

Why is logjam rated as “None” for confidentiality impact in CVSS?

The CVSS score for Logjam is (AV:N/AC:M/Au:N/C:N/I:P/A:N). As noted in that nice dynamic image interpretation, the Impact metric "Confidentiality" is described as "None" (C:N). But the description ...
3
votes
1answer
7k views

Relationship between CVSS and Risk Level in Nessus output data

In a Nessus output file, does the Risk Level (e.g. Critical, High, Medium, Low, None) depend on the CVSS score? What relationship, if any, do the Risk Level and CVSS have? Thank yo
7
votes
2answers
7k views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
4
votes
1answer
2k views

How are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
2
votes
2answers
121 views

How to calculate CVSS of an attack so that it matches those in CVEs?

I have drawn an attack graph for a file-sharing application (eg. Dropbox) where a database stores details of virtual machines Eg. memory space left, etc. I've listed some possible attacks: The ...
6
votes
5answers
2k views

Vulnerability scoring systems

Our company is developing a web app that is used for e-commerce. We want to establish a more formal scoring system for any security related issues eventually reported by us or by our clients. The ...
2
votes
2answers
305 views

Does the CVSS impact score correspond to probability?

From http://nvd.nist.gov/cvsseq2.htm, I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact, 0.275 for ...
3
votes
1answer
118 views

CVSS Temporal Data

The CVSS standard has a "temporal" component that models the changing risk associated with a vulnerability over time, such as the publication of a working exploit. But NIST's NVD doesn't provide that ...