Questions tagged [cvss]
use `cvss` if your question is related to Common Vulnerability Scoring System
67
questions
-2
votes
1
answer
69
views
How to score CVSS for these findings?
I am using CVSS 3.1 and even though I read the documentation I still doubting with numerous findings. For example:
Internet facing hostname is missing CAA and SPF DNS record. What would PR be? I ...
- 253
1
vote
4
answers
224
views
GPS metadata in uploaded pictures: vulnerability or not?
If a web application (like an internet forum, social media, etc.) does not remove GPS metadata (EXIF) from uploaded pictures, is it considered a security vulnerability or not? Why? And would it be ...
- 15.7k
0
votes
1
answer
71
views
How to assess the Privilege Required?
I am calculating the CVSS score for an issue, and I am confused about the Privileges Required (PR).
The issue is, for a client desktop app that connects to a server, the logged in user allows ...
0
votes
1
answer
89
views
CVSS v4 using lookup instead of simple formulas
I wanted to know why in the CVSSv4 there is no longer an equation where you take the input of metrics and calculate the cvss output.
Rather they take the input metrics, use it to compute a vector (ex: ...
- 73
2
votes
2
answers
410
views
CVSS3 score for XSS leading to account takeover
Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
- 85
1
vote
1
answer
322
views
CVSS3 Scope change question
Let's say I have an e-commerce organization. My organization has two security authorities A and B. The authority A manages access to data related to user orders, and the authority B manages access to ...
- 85
0
votes
1
answer
83
views
Should bounties be paid for information exposure?
An ethical hacker found that a system I own, has an exposure of information. They were able to determine the programming language, a web framework and the exact versions of both from a stack trace by ...
- 101
0
votes
1
answer
438
views
CVSS v3 and v3.1 Missing temporal metrics (Exploit Code Maturity and Remediation Level) in all CVEs using NVD API
I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have ...
- 1
0
votes
1
answer
141
views
Vulnerable Components CVSS Score
How do you map vulnerable components' CVSS scores?
Do you use the CVE CVSS score? Do you calculate again?
For example: A host is using a component that has a CVE for a high vulnerability.
Do you ...
- 1
0
votes
1
answer
121
views
CVSS scores and sub-scores
What is the difference between the exploitability score and the exploitability sub-score? And the difference between the impact score and the impact sub-score?
What are the relationships between the ...
1
vote
2
answers
156
views
CVSS Temporal guidance
I've recently been given a set of guidance notes on CVSS; but the guidance isn't making sense. I've sent a query off, but got no response. So asking here.
Say you have an exploit (can ignore base for ...
- 142
1
vote
1
answer
190
views
Help me to understand "Low Integrity" scores for parameter tampering in CVSS 3.1
I am curious about the Integrity metric in CVSS 3.1.
Low is:
"Modification of data is possible, but the attacker does not have
control over the consequence of a modification, or the amount of
...
1
vote
1
answer
398
views
What's the difference between Local and Physical attack vector in CVSS 3.1?
I'm reviewing CVSS 3.1 specification, recently.
I encounter the example below:
Sophos Login Screen Bypass Vulnerability (CVE-2014-2005)
Sophos Disk Encryption (SDE) 5.x in Sophos Enterprise Console (...
- 13
0
votes
1
answer
317
views
CVSS 3.1 -- does a scope change imply at the very least a low confidentiality impact?
So I'm looking at scoring a vulnerability, and I'm waffling on how to handle Scope and Confidentiality impact.
If scope is changed, isn't confidentiality-impact necessarily changed to at least Low? If ...
- 699
1
vote
1
answer
104
views
How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?
Let's consider the following code in a hypothetical C library.
uint8_t size;
uint8_t buf[128];
read(untrusted_fd, &size, 1);
read(untrusted_fd, buf, size);
In the early 2000s, it would be a ...
- 113
5
votes
2
answers
443
views
Why CVSS range 8 to 9 is almost inexistent
According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range.
Even compared to the low score ranges ...
- 572
0
votes
0
answers
229
views
Impact of user account deletion on Availability in CVSS v3.1?
First, some excerpts from the CVSS official docs.
According to CVSS 3.1 Specification:
While the Confidentiality and Integrity impact metrics apply to the
loss of confidentiality or integrity of data ...
- 271
0
votes
1
answer
624
views
Cacheable HTTPS Response CVSS
https://portswigger.net/kb/issues/00700100_cacheable-https-response
Applications should return caching directives instructing browsers not to store local copies of any sensitive data
Which CVSS ...
- 567
1
vote
1
answer
5k
views
What is the difference between "local" and "Adjacent" threat agents?
I am using CVSS to do the vulnerability assessment for my project.
As per documentation here is the definition of local and adjacent
Adjacent (A) The vulnerable component is bound to the network ...
- 159
0
votes
1
answer
249
views
Client-side password strength policy verification. CVSS3.1? OWASP WSTG?
Using the OWASP testing guide, if password strength policy verification is implemented only client-side, can that be considered a vulnerability? In which category?
Also which CVSS it should have?
- 567
0
votes
1
answer
123
views
CVSSv2 score of 10, but no CVSv3 score
We are working on our Vulnerability Management process and as part of that, I was going through the reports from our infrastructure vulnerability scanner. In the reports, I noticed that some of the ...
- 1,307
0
votes
2
answers
756
views
Deciding CVSS v3.1 scope parameter for a XXE vulnerability
I have a web application which is vulnerable to XXE attack. The impact of this vulnerability is, it can do a port scan by sending a malicious XML that does a request to a specific host+port in the ...
- 31
3
votes
1
answer
217
views
How to rate a CVSS score for a vulnerability on an identity provider
I'm having difficulty to rate a CVSS for an Identity Provider.
Imagine you have a vulnerability where you can bypass an authentication mechanism.
How would you rate :
Confidentiality (C)
Integrity (...
- 133
3
votes
4
answers
419
views
Risk of web admin portal without extra authentication steps
more of a philosophical question, suppose there is one behavior which allows an attacker to do something with high impact but by itself cannot be used to cause that impact. For example, internet ...
- 31
2
votes
2
answers
494
views
CVSS and chained vulnerabilities
Let's say a website has two vulnerabilities:
Information Disclosure
reflected XSS
Their impact by themselves is limited on the specific site, but when chained together, the impact is raised too high ...
- 121
2
votes
2
answers
608
views
Is it correct to assign a CVSS to a misconfiguration?
This morning, talking to a colleague, we were discussing the correction of assigning a CVSS to a bad configuration. Specifically, we were discussing whether using HTTP instead of HTTPS should have an ...
- 321
2
votes
0
answers
182
views
What is the correct CVSS “Privileges Required” score for a local privilege escalation where the vulnerable component doesn’t do authorization?
A locally installed application, which runs a daemon as root, creates a directory which is world-writable. By changing files in this world-writable directory, it’s possible to cause the daemon to ...
- 121
20
votes
5
answers
5k
views
Can a network vulnerability be exploited locally?
I've been looking for information about vulnerability classification and it's not completely clear to me.
Reading the CVSS documentation (2.1.1. Access Vector) I observe the following explanation ...
- 321
0
votes
1
answer
128
views
How to rate CVSS when PR is low but UI of admin user is required
I have a situation where an attacker with low privileges can perform an attack. However, in order to complete the attack, the system has to be restarted, which can only be done by the admin account.
...
5
votes
1
answer
4k
views
API to Get CVE Info [closed]
I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:...
2
votes
3
answers
378
views
Do I need to worry about vulnerabilities that require administrative privileges to exploit?
I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines.
What confuses me is that fact that those vulerabilities are scored with
a high risk score, but
require(...
- 3,036
3
votes
1
answer
1k
views
How to rate CVSS3's "Privileges Required" when an attacker can create an account?
The Common Vulnerability Scoring System Version 3.0 rates the severity of vulnerability depending on factors such as:
Attack Vector (AV) - What kind of access does an attacker need? Can they do it ...
user163495
3
votes
3
answers
9k
views
CVSS Score for self-XSS (stored XSS)
I have a web application which is vulnerable to stored, self-XSS attack. Proper encoding is not done In the place where the data from a database (set by the same user) is added to response.
However, ...
- 31
1
vote
1
answer
122
views
Common practice when CVSS v2 score over represents severity
We're formalizing our vulnerability management process and decided to use CVSS V2 to help decide what vulnerabilities to remediate. We're running into a situation where a vulnerability's severity ...
- 23
1
vote
2
answers
803
views
CVSS3.0 impact score and exploitability score
I'm having some trouble calculating CVSS v3.0 scores in some findings I've encountered.
In particular, one finding is a simple server information disclosure via default error pages. It is very ...
- 421
1
vote
1
answer
486
views
Penetration Testing of IaaS/PaaS environment - CVSS Score
How can I measure the effectiveness of a Penetration Testing carried out in a Cloud Environment (IaaS/PaaS) by a third Party Vendor ? Should I ask for a CVSS score or something else ?
Any advise will ...
- 103
1
vote
1
answer
228
views
Why is CVE-2017-5461 rated Critical with CVSS Score 9.8?
A while ago I came across this CVE-2017-5461, which is rated 9.8 both on NVD and Redhat Portal, with a CVSS base string of
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
for those who is not very ...
- 281
0
votes
2
answers
1k
views
Is there a CVE or CVSS for enumeration of ports?
Lets say that there is a company which does not have a firewall and it is possible to perform an enumeration of ports and services.
Could it be considered a vulnerability if it provides ...
- 103
6
votes
1
answer
543
views
Can any of the INTEL-SA-00086 vulnerabilities be exploited by an unprivileged user?
Several of the latest Intel Management Engine vulnerabilities are listed as local vulnerabilities, allowing code executing on the system to elevate its privileges to ME context. One of them (CVE-2017-...
- 66.5k
1
vote
1
answer
119
views
Can CVSS score be different from that calculated from vector
In most databases, there two fields: CVSS vector and CVSS score. It's logical that if we calculate score from vector, it's supposed to be equal to the score field.
But, can it be manually 'tuned' and ...
- 13
1
vote
3
answers
309
views
Clarification regarding CVSS
I need clarifications regarding CVSS:
What is better for the references?
CVSSv2 or CVSSv3?
V3 is new, but V2 is mature.
Why there are differences in CVSS scores between NVD NIST repository and Red ...
- 1,479
6
votes
1
answer
9k
views
What does "scope" mean in CVSS v3?
In CVSS v3, the "scope" indicates whether a vulnerability in an application impacts resources beyond its means. It can have the values "changed" or "unchanged".
I don't fully understand when the ...
- 29.6k
3
votes
1
answer
542
views
CVSS Score Remote or Local Scenario
I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
- 1,100
1
vote
1
answer
673
views
CVSS score for no-input validation
During a security assesment I found that an application wrote JavaScript from input fields directly in the database. The application it self had good output sanitization so no XSS was possible in that ...
- 879
6
votes
1
answer
347
views
Why does the CVSS3 score increase when the confidentiality impact decreases?
Consider these two cases:
1) Impact on Confidentiality as High
2) Impact on Confidentiality as Low
Please note all other parameters are unchanged and environmental parameters are set as High.
Now, ...
- 1,791
0
votes
1
answer
713
views
Public vulnerability feed with CVSS v3
NIST NVD publishes XML feeds of CVEs but, as far as I'm concerned, only with CVSS v2 vectors. CVSS v3 results are available on web portal.
Is there available any up to date, processing friendly, raw ...
- 21
2
votes
1
answer
972
views
Why do CVSS scores change?
In National Vulnerability Database page (https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0778), from the change history, we can see CVSS v3 scores has been changed overtime. For example, CVE-...
26
votes
5
answers
4k
views
Is unauthorised deletion an integrity or availability issue?
During a web application test I have discovered a parameter tampering issue that allows a user to delete comments left by other users. They can't modify the content of other users' comments, and they ...
- 33.4k
4
votes
1
answer
1k
views
Why doesn't CVSSv2 consider XSS to have a confidentiality impact?
From the CVSSv2 specification:
SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the ...
- 29.5k
3
votes
2
answers
3k
views
Why is XSS scored with partial impact to integrity in CVSS V2?
From CVSS v2 complete guide :
"SCORING TIP #2: When scoring a vulnerability, consider the direct
impact to the target host only. For example, consider a cross-site
scripting vulnerability: the ...
- 279