Questions tagged [cvss]
use `cvss` if your question is related to Common Vulnerability Scoring System
8
questions with no upvoted or accepted answers
6
votes
1
answer
382
views
Does the ability to delete data impact availability in CVSS v2?
NIST SP 800-33 2.0.1 says that "availability" part of the CIA triad protects against intentional or accidental attempts to either:
perform unauthorized deletion of data or
otherwise cause a denial ...
- 440
2
votes
0
answers
237
views
What is the correct CVSS “Privileges Required” score for a local privilege escalation where the vulnerable component doesn’t do authorization?
A locally installed application, which runs a daemon as root, creates a directory which is world-writable. By changing files in this world-writable directory, it’s possible to cause the daemon to ...
- 121
1
vote
0
answers
70
views
Information on the Exploitation and Automatability Data for Vulnerable components
Is there any tool providing information such as exploitability state (i.e., None, POC & Functional/Active) and automatability data for a specified vulnerable component name and version?
0
votes
1
answer
208
views
How to assess the Privilege Required?
I am calculating the CVSS score for an issue, and I am confused about the Privileges Required (PR).
The issue is, for a client desktop app that connects to a server, the logged in user allows ...
0
votes
1
answer
616
views
CVSS v3 and v3.1 Missing temporal metrics (Exploit Code Maturity and Remediation Level) in all CVEs using NVD API
I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have ...
- 1
0
votes
0
answers
295
views
Impact of user account deletion on Availability in CVSS v3.1?
First, some excerpts from the CVSS official docs.
According to CVSS 3.1 Specification:
While the Confidentiality and Integrity impact metrics apply to the
loss of confidentiality or integrity of data ...
- 271
0
votes
1
answer
224
views
CVSS scores and sub-scores
What is the difference between the exploitability score and the exploitability sub-score? And the difference between the impact score and the impact sub-score?
What are the relationships between the ...
-1
votes
1
answer
280
views
Vulnerable Components CVSS Score
How do you map vulnerable components' CVSS scores?
Do you use the CVE CVSS score? Do you calculate again?
For example: A host is using a component that has a CVE for a high vulnerability.
Do you ...
- 1