paint-brush
Using the Common Vulnerability Scoring Systemby@secopsolution
7,336 reads
7,336 reads

Using the Common Vulnerability Scoring System

by SecOps SolutionDecember 9th, 2022
Read on Terminal Reader
Read this story w/o Javascript
tldt arrow

Too Long; Didn't Read

Common vulnerability scoring system (CVSS) is a way to assign scores to vulnerability on the basis of their principal characteristics. CVSS has two versions of the scoring system **CVSS2 and CVSS3**, the cvss2 was released in the year 2007 and had a scoring range of 0 - 10 with three severity levels low, medium, high, and high. The CVSS score ranges from **0.0 to 10.0**, where 1.0 is considered as least severe and the most severe. The Report Confidence metric measures the degree of assurance in the existence of the vulnerability.

Company Mentioned

Mention Thumbnail

Coin Mentioned

Mention Thumbnail
featured image - Using the Common Vulnerability Scoring System
SecOps Solution HackerNoon profile picture


The common vulnerability scoring system (CVSS) is a way to assign scores to vulnerability on the basis of their principal characteristics. This score indicates the severity of a vulnerability and on that basis, it can be categorized into low, medium, high, and critical severity which can be used by the organization to prioritize the vulnerabilities present in the system.


CVSS has two versions of the scoring system CVSS2 and CVSS3, the cvss2 was released in the year 2007 and had a scoring range of 0 - 10 with three severity levels low, medium, and high whereas cvss3 is launched in the year 2015 having a scoring range of 0 - 10 with 5 severity levels none, low, medium, high, and critical. The Base, Temporal, and Environmental metric groups all remained the same, although there were some changes within the Base and Environmental groups to find out the accurate scores of the vulnerability.


How CVSS works


The CVSS score ranges from 0.0 to 10.0, where 1.0 is considered as least severe and 10.0 is the most severe. Mapping of CVSS score with qualitative ratings:


Base Score range

Severity

0.0

None

0.1 – 3.9

Low

4.0 – 6.9

Medium

7.0 – 8.9

High

9.0 – 10.0

Critical



CVSS Score Metrics


A CVSS score is derived from three sets of metrics Base, Terminal, and Environmental. These three metrics cover the different characteristics of a vulnerability, its impact, and environmental tolerance over time.


Base Metrics


The base metrics represent the base score ranging from 0 - 10 and the inherent characteristics of a vulnerability that is, these characteristics don’t change over time. It is made up of two sets of Metrics:


Exploitability Metrics:


  • Attack vector
  • Attack complexity
  • Privileges required
  • User interaction
  • Scope


Impact Metrics:


  • Confidentiality impact
  • Integrity Impact
  • Availability Impact


Temporal Metrics


The temporal Metrics represent the characteristics of a vulnerability that change over time. Additionally, it contains the Report Confidence metric, which measures the degree of assurance in the existence of the vulnerability. It consists of three metrics groups:


  • Exploit code maturity
  • Remediation Level
  • Report Confidence


Environmental Metrics


The environmental metrics represent the characteristics of a vulnerability that are relevant and have an impact on a particular user’s environment. Environmental metrics categories include:


  • Collateral damage potential
  • Confidentiality requirement
  • Integrity requirement
  • Availability requirement


For example, consider a vulnerability having a CVSS score of 6.5 and having a vector:

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:R/CR:H/IR:H/AR:L/MAV: X/MAC:X/MPR:X/MUI:X/MS:X/MC:X/MI: X/MA:X


The above vector value indicates:


AV: L - (Attack Vector) It means that the vulnerability is exploitable by local access.

AC: L - (Attack complexity) This vector value indicates that a specialized access condition does not exist.

PR: L - (Privileges required) It indicates that the attacker is authorized with privileges that provide basic user capabilities.

UI: N - (User interaction) The vulnerable system can be exploited without interaction from any user.

S: U - (Scope) An exploited vulnerability can only affect resources managed by the same authority.

C: H - (Confidentiality impact) There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker.

I: H - (Integrity impact) There is a total loss of integrity.

A: H - (Availability impact) Loss of availability means the attacker is able to fully deny access to resources in the impacted component.

E: U - (Exploit code maturity) No exploit code is available, or an exploit is entirely theoretical.

RL: O - (Remediation Level) A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.

RC: R - (Report Confidence) Reasonable confidence exists, however, that the big is reproducible and at least one impact is able to be verified.

CR: H - (Confidentiality requirement) Loss of confidentiality is likely to have a catastrophic adverse effect on the organization.

IR: H - (Integrity requirement) Loss of integrity is likely to have a catastrophic adverse effect on the organization.

AR: L - (Availability requirement) Loss of availability is likely to have a limited adverse effect on the organization.


Also published here.