Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [cvss]

use `cvss` if your question is related to Common Vulnerability Scoring System

Filter by
Sorted by
Tagged with
-2 votes
0 answers
25 views

How consistent are CVSSv4 scores? [closed]

The University of Erlangen-Nuremberg (Germany) is conducting a research study to investigate the consistency of CVSSv4 (Common Vulnerability Scoring System). If you are currently assessing ...
fau-cs1-study's user avatar
0 votes
1 answer
101 views

How to calculate CVSS score of a finding detected in the source code?

While I was doing source code review of API handlers for REST APIs, I found a security issue. This issue is that some methods have the annotation @PreAuthorize("permitAll()"). If I want to ...
anonymous's user avatar
0 votes
1 answer
171 views

CVSS attack vector adjacent vs network

I am trying to calculate a CVSS score for a vulnerability. In my case, to exploit the vulnerability you should have network access to the server, which is sitting behind a firewall. This server is ...
anonymous's user avatar
1 vote
0 answers
65 views

Information on the Exploitation and Automatability Data for Vulnerable components

Is there any tool providing information such as exploitability state (i.e., None, POC & Functional/Active) and automatability data for a specified vulnerable component name and version?
sad_semicolon's user avatar
-2 votes
1 answer
198 views

How to score CVSS for these findings?

I am using CVSS 3.1 and even though I read the documentation I still doubting with numerous findings. For example: Internet facing hostname is missing CAA and SPF DNS record. What would PR be? I ...
user1880405's user avatar
1 vote
4 answers
379 views

GPS metadata in uploaded pictures: vulnerability or not?

If a web application (like an internet forum, social media, etc.) does not remove GPS metadata (EXIF) from uploaded pictures, is it considered a security vulnerability or not? Why? And would it be ...
reed's user avatar
  • 15.8k
0 votes
1 answer
163 views

How to assess the Privilege Required?

I am calculating the CVSS score for an issue, and I am confused about the Privileges Required (PR). The issue is, for a client desktop app that connects to a server, the logged in user allows ...
ethicalhacker's user avatar
0 votes
1 answer
258 views

CVSS v4 using lookup instead of simple formulas

I wanted to know why in the CVSSv4 there is no longer an equation where you take the input of metrics and calculate the cvss output. Rather they take the input metrics, use it to compute a vector (ex: ...
rudeus123's user avatar
3 votes
2 answers
898 views

CVSS3 score for XSS leading to account takeover

Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
mateleco's user avatar
  • 110
1 vote
1 answer
442 views

CVSS3 Scope change question

Let's say I have an e-commerce organization. My organization has two security authorities A and B. The authority A manages access to data related to user orders, and the authority B manages access to ...
mateleco's user avatar
  • 110
0 votes
1 answer
120 views

Should bounties be paid for information exposure?

An ethical hacker found that a system I own, has an exposure of information. They were able to determine the programming language, a web framework and the exact versions of both from a stack trace by ...
Ben Johnson's user avatar
0 votes
1 answer
557 views

CVSS v3 and v3.1 Missing temporal metrics (Exploit Code Maturity and Remediation Level) in all CVEs using NVD API

I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have ...
Tlopasha's user avatar
-1 votes
1 answer
228 views

Vulnerable Components CVSS Score

How do you map vulnerable components' CVSS scores? Do you use the CVE CVSS score? Do you calculate again? For example: A host is using a component that has a CVE for a high vulnerability. Do you ...
Ton Lim's user avatar
0 votes
1 answer
201 views

CVSS scores and sub-scores

What is the difference between the exploitability score and the exploitability sub-score? And the difference between the impact score and the impact sub-score? What are the relationships between the ...
Derek Huang's user avatar
1 vote
2 answers
216 views

CVSS Temporal guidance

I've recently been given a set of guidance notes on CVSS; but the guidance isn't making sense. I've sent a query off, but got no response. So asking here. Say you have an exploit (can ignore base for ...
Amiga500's user avatar
  • 142
1 vote
1 answer
234 views

Help me to understand "Low Integrity" scores for parameter tampering in CVSS 3.1

I am curious about the Integrity metric in CVSS 3.1. Low is: "Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of ...
Problem Child's user avatar
1 vote
1 answer
544 views

What's the difference between Local and Physical attack vector in CVSS 3.1?

I'm reviewing CVSS 3.1 specification, recently. I encounter the example below: Sophos Login Screen Bypass Vulnerability (CVE-2014-2005) Sophos Disk Encryption (SDE) 5.x in Sophos Enterprise Console (...
Mehran2021's user avatar
0 votes
1 answer
393 views

CVSS 3.1 -- does a scope change imply at the very least a low confidentiality impact?

So I'm looking at scoring a vulnerability, and I'm waffling on how to handle Scope and Confidentiality impact. If scope is changed, isn't confidentiality-impact necessarily changed to at least Low? If ...
Sidney's user avatar
  • 699
1 vote
1 answer
137 views

How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?

Let's consider the following code in a hypothetical C library. uint8_t size; uint8_t buf[128]; read(untrusted_fd, &size, 1); read(untrusted_fd, buf, size); In the early 2000s, it would be a ...
比尔盖子's user avatar
5 votes
2 answers
524 views

Why CVSS range 8 to 9 is almost inexistent

According to cvedetail graph Vulnerability Distribution By CVSS Scores, we can see that CVE with a CVSS in range 8 to 9 are the less represented of all range. Even compared to the low score ranges ...
Whysmerhill's user avatar
0 votes
0 answers
270 views

Impact of user account deletion on Availability in CVSS v3.1?

First, some excerpts from the CVSS official docs. According to CVSS 3.1 Specification: While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data ...
drox's user avatar
  • 271
0 votes
1 answer
767 views

Cacheable HTTPS Response CVSS

https://portswigger.net/kb/issues/00700100_cacheable-https-response Applications should return caching directives instructing browsers not to store local copies of any sensitive data Which CVSS ...
Maicake's user avatar
  • 567
1 vote
1 answer
6k views

What is the difference between "local" and "Adjacent" threat agents?

I am using CVSS to do the vulnerability assessment for my project. As per documentation here is the definition of local and adjacent Adjacent (A) The vulnerable component is bound to the network ...
kudlatiger's user avatar
0 votes
1 answer
306 views

Client-side password strength policy verification. CVSS3.1? OWASP WSTG?

Using the OWASP testing guide, if password strength policy verification is implemented only client-side, can that be considered a vulnerability? In which category? Also which CVSS it should have?
Maicake's user avatar
  • 567
0 votes
1 answer
225 views

CVSSv2 score of 10, but no CVSv3 score

We are working on our Vulnerability Management process and as part of that, I was going through the reports from our infrastructure vulnerability scanner. In the reports, I noticed that some of the ...
Sreeraj's user avatar
  • 1,307
0 votes
2 answers
863 views

Deciding CVSS v3.1 scope parameter for a XXE vulnerability

I have a web application which is vulnerable to XXE attack. The impact of this vulnerability is, it can do a port scan by sending a malicious XML that does a request to a specific host+port in the ...
NShani's user avatar
  • 31
3 votes
1 answer
268 views

How to rate a CVSS score for a vulnerability on an identity provider

I'm having difficulty to rate a CVSS for an Identity Provider. Imagine you have a vulnerability where you can bypass an authentication mechanism. How would you rate : Confidentiality (C) Integrity (...
Kantium's user avatar
  • 133
3 votes
4 answers
501 views

Risk of web admin portal without extra authentication steps

more of a philosophical question, suppose there is one behavior which allows an attacker to do something with high impact but by itself cannot be used to cause that impact. For example, internet ...
thevpt's user avatar
  • 31
2 votes
2 answers
553 views

CVSS and chained vulnerabilities

Let's say a website has two vulnerabilities: Information Disclosure reflected XSS Their impact by themselves is limited on the specific site, but when chained together, the impact is raised too high ...
tturbox's user avatar
  • 141
2 votes
2 answers
748 views

Is it correct to assign a CVSS to a misconfiguration?

This morning, talking to a colleague, we were discussing the correction of assigning a CVSS to a bad configuration. Specifically, we were discussing whether using HTTP instead of HTTPS should have an ...
vuln newbie's user avatar
2 votes
0 answers
222 views

What is the correct CVSS “Privileges Required” score for a local privilege escalation where the vulnerable component doesn’t do authorization?

A locally installed application, which runs a daemon as root, creates a directory which is world-writable. By changing files in this world-writable directory, it’s possible to cause the daemon to ...
C Snover's user avatar
  • 121
20 votes
5 answers
5k views

Can a network vulnerability be exploited locally?

I've been looking for information about vulnerability classification and it's not completely clear to me. Reading the CVSS documentation (2.1.1. Access Vector) I observe the following explanation ...
vuln newbie's user avatar
0 votes
1 answer
158 views

How to rate CVSS when PR is low but UI of admin user is required

I have a situation where an attacker with low privileges can perform an attack. However, in order to complete the attack, the system has to be restarted, which can only be done by the admin account. ...
DentistOfDetroit's user avatar
5 votes
1 answer
4k views

API to Get CVE Info [closed]

I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:...
a_dude_in_an_office's user avatar
2 votes
3 answers
461 views

Do I need to worry about vulnerabilities that require administrative privileges to exploit?

I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines. What confuses me is that fact that those vulerabilities are scored with a high risk score, but require(...
Heinzi's user avatar
  • 3,288
3 votes
1 answer
1k views

How to rate CVSS3's "Privileges Required" when an attacker can create an account?

The Common Vulnerability Scoring System Version 3.0 rates the severity of vulnerability depending on factors such as: Attack Vector (AV) - What kind of access does an attacker need? Can they do it ...
user avatar
3 votes
3 answers
9k views

CVSS Score for self-XSS (stored XSS)

I have a web application which is vulnerable to stored, self-XSS attack. Proper encoding is not done In the place where the data from a database (set by the same user) is added to response. However, ...
NShani's user avatar
  • 31
1 vote
1 answer
146 views

Common practice when CVSS v2 score over represents severity

We're formalizing our vulnerability management process and decided to use CVSS V2 to help decide what vulnerabilities to remediate. We're running into a situation where a vulnerability's severity ...
anchovie's user avatar
1 vote
2 answers
973 views

CVSS3.0 impact score and exploitability score

I'm having some trouble calculating CVSS v3.0 scores in some findings I've encountered. In particular, one finding is a simple server information disclosure via default error pages. It is very ...
user1118764's user avatar
1 vote
1 answer
521 views

Penetration Testing of IaaS/PaaS environment - CVSS Score

How can I measure the effectiveness of a Penetration Testing carried out in a Cloud Environment (IaaS/PaaS) by a third Party Vendor ? Should I ask for a CVSS score or something else ? Any advise will ...
wonder's user avatar
  • 103
1 vote
1 answer
255 views

Why is CVE-2017-5461 rated Critical with CVSS Score 9.8?

A while ago I came across this CVE-2017-5461, which is rated 9.8 both on NVD and Redhat Portal, with a CVSS base string of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for those who is not very ...
Sajuuk's user avatar
  • 291
0 votes
2 answers
1k views

Is there a CVE or CVSS for enumeration of ports?

Lets say that there is a company which does not have a firewall and it is possible to perform an enumeration of ports and services. Could it be considered a vulnerability if it provides ...
Cod1ngFree's user avatar
6 votes
1 answer
576 views

Can any of the INTEL-SA-00086 vulnerabilities be exploited by an unprivileged user?

Several of the latest Intel Management Engine vulnerabilities are listed as local vulnerabilities, allowing code executing on the system to elevate its privileges to ME context. One of them (CVE-2017-...
forest's user avatar
  • 66.8k
1 vote
1 answer
142 views

Can CVSS score be different from that calculated from vector

In most databases, there two fields: CVSS vector and CVSS score. It's logical that if we calculate score from vector, it's supposed to be equal to the score field. But, can it be manually 'tuned' and ...
Nostr's user avatar
  • 13
1 vote
3 answers
341 views

Clarification regarding CVSS

I need clarifications regarding CVSS: What is better for the references? CVSSv2 or CVSSv3? V3 is new, but V2 is mature. Why there are differences in CVSS scores between NVD NIST repository and Red ...
Michael's user avatar
  • 1,469
6 votes
1 answer
11k views

What does "scope" mean in CVSS v3?

In CVSS v3, the "scope" indicates whether a vulnerability in an application impacts resources beyond its means. It can have the values "changed" or "unchanged". I don't fully understand when the ...
Sjoerd's user avatar
  • 30.8k
3 votes
1 answer
607 views

CVSS Score Remote or Local Scenario

I have to deal with a lot of CVSSv2 and CVSSv3 scores for many, many years. What troubles me like forever is what default attack scenario shall be defined for a vulnerability. Let's take a malicious ...
Marc Ruef's user avatar
  • 1,130
1 vote
1 answer
724 views

CVSS score for no-input validation

During a security assesment I found that an application wrote JavaScript from input fields directly in the database. The application it self had good output sanitization so no XSS was possible in that ...
Wealot's user avatar
  • 899
6 votes
1 answer
372 views

Why does the CVSS3 score increase when the confidentiality impact decreases?

Consider these two cases: 1) Impact on Confidentiality as High 2) Impact on Confidentiality as Low Please note all other parameters are unchanged and environmental parameters are set as High. Now, ...
one's user avatar
  • 1,821
0 votes
1 answer
771 views

Public vulnerability feed with CVSS v3

NIST NVD publishes XML feeds of CVEs but, as far as I'm concerned, only with CVSS v2 vectors. CVSS v3 results are available on web portal. Is there available any up to date, processing friendly, raw ...
Dave Yarsky's user avatar