Hot answers tagged

32

As pointed out in this (unanswered) question, Availability in CVSSv3 is about how well the web service performs, not whether its data is available: While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the impacted component, this metric refers to the loss of ...


13

The vulnerability applies in situations where: The attacker can do a MitM at the network level (usually through DNS poisoning or by operating a fake open WiFi access point). A Web site offers some services over HTTPS. Some parts of the Web site require a user authentication. The Web server accepts to to SSL/TLS renegotiations. The Web server is ready to ...


12

I would say it presents a clear Availability issue as the attacker is able to completely remove that specific resource and prevent other users' ability to access. I would also say there is an Integrity issue too. The calculator defines a low score on integrity as "modification of data is possible" which I would say is certainly the case here. To answer ...


6

An issue of "absence of logout button" is absolutely not a physical vector. Physical means you have direct physical access to the server, as in you're standing right in front of it. A more appropriate one for "physical" would be a lack of full-disk encryption, since physical access in the context of server theft would result in an attacker getting hold of ...


6

First of all, there are three different metrics to calculate the global CVSS score. These are: Base Metrics, Temporal Metrics and Environmental Metrics. Temporal Metrics and Environmental Metrics are optional and these are calculated using the Base ones as an input value. To have a better overview of these metrics and their equation, take a look of this ...


6

generally Nessus severity ratings will line up to the brackets outlined here for CVSS Score --> severity mappping so NVD Vulnerability Severity Ratings NVD provides severity rankings of "Low," "Medium," and "High" in addition to the numeric CVSS scores but these qualitative rankings are simply mapped from the numeric CVSS base scores: ...


5

Tony Cox and Jeff Lowder have provided some excellent commentary on CVSS (Indeed SIRA includes lots of good discussion). Their goal is bit broader than yours, but I think that the referenced article provides an index to commentary about CVSS. @Metahuman's post points out that CVSS can be supplemented. The Department of State's iPost system found that CVSS ...


4

We use a scoring system based on DREAD where we score the 5 elements Damage, how bad is the vulnerability Reliability, does the vulnerability work all the time or just some of the time Exploitability, how much effort is it to exploit the vulnerability Affected Users, number of people impacted Discoverability, how easy would to be to discover this ...


4

I sent this to FIRST and I got this response from the their team. We agree that this is a problem, and we plan to address it in a future revision to the standard. We used a set of test cases to ensure intuitive scores for all inputs during the creation of the CVSS v3.0 formulas, but we missed this case. I don't believe people often set CR, IR and AR to ...


4

I am the lead architect of a very popular vulnerability database and we face similar problems. At the moment we have nearly 90'000 vulnerability entries with a CVSSv2 base and temp score. We are adding CVSSv3 scores and trying to convert most of the old data. I am going to discuss this transformation only to illustrate the basic principle of such. The most ...


4

INTEGRITY After deletion, the resulting dataset will assert that no such comment was ever left. That assertion is in error.


3

I can't tell you how NVD came up with their, let's call it baseline rating. But I can tell you that not all vendors have followed that baseline rating. Ratings survey (AV:N/AC:M/Au:N/C:N/I:P/A:N), 4.3, NVD And if manually change this to (AV:N/AC:M/Au:N/C:P/I:P/A:N), then you get Overall CVSS Score 5.8. (AV:N/AC:M/Au:N/C:N/I:P/A:N), 4.3, Juniper. Same as ...


3

If you go by the spec and examples from first, neither is correct. Let's start with examples: CVE-2015-1098 - which is about DoS in iWork via a specifically crafted file - is scored as AV:L and UI:R. CVE-2009-0658 - which is about a buffer overflow in adobe acrobat via a specifically crafted file - is also scored as AV:L and UI:R. The reason in both ...


3

Yes it does. A CVSS 3 base score is calculated using eight factors: Impact is determined by: scope, confidentiality, integrity and availability. Likelihood is determined by: attack vector, attack complexity, privileges required and user interaction. A good place to learn about these is the online calculator. The problem with CVSS and Heartbleed is that ...


3

Based on your requirements, you might want to look at Common Weakness Enumeration (CWE). http://cwe.mitre.org/about/index.html. It is a community backed solution for describing software security vulnerabilities, and as a baseline for vulnerability remediation activities.


3

CVSS is a scoring system, it is subjective and is open to interpretation by the person scoring the vulnerability, if you look at the two scores you'll see that one rates high confidentiality impact and one rates none. On which one to use, there is no real right answer here, it's what's right for you. In my organisation we use version 3, this guide from ...


3

Your question does not distinguish between administrative privileges, and "highest privileges possible". Where to go when you have elevated privileges? "Elevated privileges" are not the highest you can go. Even though you might be administrator, the operating system kernel can still deny you access to some resources or to perform some actions. Furthermore, ...


3

You can use the CVE API that Red Hat maintains. It has a lot of options to search for a vulnerability given a CVE or other parameters, you can even run a search by components with a range of dates (before and after filters). An example of the query that you may be interested in, will be something like this: https://access.redhat.com/labs/securitydataapi/...


2

CVSS is a reasonable system for evaluating vulnerabilities, and is a good framework for determining possible technical impact, however it's only part of the story. What matters to a business is how much money it can potentially lose if a vulnerability is exploited, or the system goes down. If a vulnerability could be introduced that could be used to create a ...


2

I used to contract for iDefense and then later on for iSIGHT Partners, at both places we used the full CVSSv2 scoring including temporal data and reports were updated as exploit code came out/etc. (in fact this was on of the major priorities for us). iDefense got acquired by Verisign, I can only assume they still do this kind of work (it's been like 4+ years ...


2

The answer is pretty simple. Since its an indirect effect of the XSS. Example: A vulnerability that allows you to read the cookies would have a confidentiality impact. But a vulnerability that allows you to inject XSS has a integrity impact (allows you to change the page), but as you can arbitarily change the page, to a malicious page that steals the cookies,...


2

Example for impact on integrity: Say, there is a profile update page which has CSRF token implemented , but reflected XSS is also present. Now you can steal this token with the help of XSS and you can cause unwanted changes in the profile of the victim. Here is the article for your reference. Many of the XSS vulnerabilities were marked with PARTIAL impact ...


2

The score would be 0.0. Since there is no immediate impact, the confidentiality, integrity and availability would be set to none, which would make the score 0.0. Also, it is not necessarily a security issue that user input is saved as-is in the database. The important thing is that it is correctly encoded on output.


2

Generally speaking, vulnerabilities are rescored as they become better understood. It seems that Mitre often scores something in a worst case scenario and then lowers the score as the issue is studied some more. As to the this particular vulnerability, it's not 100% clear, but the scoring was changed at the same time they made several other changes - one ...


2

The scores are different, bcs this vulnerability is differently understood. In case of RedHat, they suggest that the vulnerability can be used to only crash the application. In case of NVD, the vulnerability can be used to execute arbitrary code. According to vendor’s advisory https://curl.haxx.se/docs/adv_20160914.html NVD was wrong to assume RCE. The ...


2

First of all, bigger PR makes lower risk ratings, it will not increase scores. At that https://www.first.org/cvss/cvss-v3-guide.pdf guide (page 18) low privilege will be 0.62 and high will be 0.27, they will be used at multiplication. You can calculate V3 scores at https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator to see results. To determining your ...


1

NIST follows trends and recently has added new (beta) JSON feeds with CVSSv3


1

I'm not familiar with CVSS, but as a sysadmin, I'd take your problem to be an integrity issue - that is, one part of the system is incorrectly able to affect another part of it. In your case, that's user B is able to delete user A's comments. It's unlikely a sysadmin would be able to resolve this problem without some app changes, but one could imagine a ...


1

It depends on whether your service has extensive backup procedures in place. If your backup procedures take into account bugs and user errors that could result in data loss, and the user submits a request to have this data restored, or you discover the vulnerability and are able to assert that all comments that were improperly deleted are still available in ...


1

The remediation level is a property of the vulnerability: is it fixed or not? Let's translate each level to CVE-2016-3714 to see a concrete example: Unavailable: there's no fix or mitigation available. Most bugs start in this level Workaround: the developers have yet to pitch in, but you can mitigate the risk by checking the magic number of uploaded images ...


Only top voted, non community-wiki answers of a minimum length are eligible