CVSS Explained

What Is CVSS?

The common vulnerability scoring system (CVSS) is open and free to industry for evaluating the seriousness of the software security vulnerabilities and is used in vulnerability management software. CVSS gives scores to vulnerabilities per the seriousness of the threat. Scores are computed considering several metrics. Scores are given between 0-10, with most severe score being 10.

First and CVSS

FIRST.Org, Inc (FIRST) is a non-profit organization based out of US that owns and manages CVSS. It is not required to be a member of FIRST to utilize or implement CVSS but FIRST does require any individual or organization give appropriate attribution while using CVSS. FIRST also states that any individual or organization that publishes scores follow the guideline so that anyone can understand how the scare was calculated.

CVE vs CVSS

Common Vulnerability Scoring System (CVSS) is a universal metric that measures the severity of a security vulnerability.  This makes it an integral part of vulnerability scanning tools.  Common Vulnerabilities and Exposures (CVE) is a list of publicly known and reported vulnerabilities.

Do All Vulnerabilities have a CVSS?

If it’s a publicly known vulnerability, CVSS has a score for it.  The scores range from 0.0 to 10.0, which are based on a large number of varied, grouped metrics.

What are CVSS Metrics Based Off Of?

• Exploitability – Exploitability metrics are based on the characteristics of the vulnerable component, with four sub sections; attack vector, attack complexity, privileges required, and user interaction.
• Attack Vector – this metric is based on the level of access required to exploit a vulnerability.  A higher score represents that an exploit can be executed remotely outside of the organization vs a lower score requires an attack to be at a physical on-premise location.
• Attack Complexity – this metric is based on things outside of an attacker’s control, such as key theft or a middle-man attack.  The higher score is based on extra effort the attacker needs to take outside of the cyber attack itself.
• Required Privileges – this metric is based on the attacker’s privileges to exploit a vulnerability.  A higher score represents the level of administration privileges that are required to carry out an attack, whereas a lower score represents little to no privileges required. part.
• User Interaction – this metric is based on if the attacker needs to recruit a willing or unknowing person in order to complete the attack.  A higher score represents no additional participation needed.
• Scope – Scope metrics are based on the number of components needed to exploit a vulnerability.  The higher score if one exploit attack can lead into a deeper backend system attack.
• Impact – Impact metrics are based on actual outcomes from an attack result.  There are three sub sections that weigh into this metric; confidentiality, integrity, and availability.
• Confidentiality – this metric is based on the amount of data the attacker has access to.  The higher score equals the most data the attacker can access, lower means no data can be reached.
• Integrity – this metric is based on the ability of the attacker to alter data on the exploited system.  The score is high if the attacker can completely or severely modify the data.
• Availability – this metric is based on the system loss once it’s exploited.  A higher score means the system will no longer be accessible by authorized users because of an attack.

1. Exploitability metric

1.1 Attack vector – shows how the vulnerability can be exploited.

1.2 Attack complexity (AC) – This metric depicts the situations that are not under the attackers control and are required to exploit vulnerability.

1.3 Privileges Required (PR) shows the amount of privileges the attacker must have to exploit the vulnerability successfully.

1.4 User interaction (UI) it is a user oriented metric. It determines whether a separate user must be present or the attacker or alone exploit the vulnerability.

1.5 Scope scope refers to the group of privileges that are characterized by a computing authority when giving access to computing resources. These privileges are appointed based on a technique of approval and identification.

2. Impact Metrics

2.1 Confidentiality Impact (C) this metrics limits access to information and reveals information only to authorized users. Also, prevents disclosure of information to unauthorized users.

2.2 Integrity impact (I) Measures the true nature of the information and how much it can be trusted. Successful exploitation of vulnerability is measured through impact to integrity.

2.3 Availability impact (A) Refers to how much information resources are accessible.

Temporal Metrics

1. Exploit code maturity (E) Exploit codes that are publicly available and are easy to use gives advantage to a potential attacker. This metric is based on the current state of techniques that measures the possibility of the vulnerability attack.

2. Redemption level (RL) – The remediation level of a vulnerability is an imperative component for prioritization. The average weakness is unpatched when first distributed.

3. Report confidence (RC) – At times only the presence of vulnerabilities is made public without giving specific details. This metric helps in measuring the credibility of the information and amount of confidence in the existence of the vulnerability.

Environmental metrics

1. Security requirements (CR, IR, AR) – This metric helps in customization of CVSS score based on the affected IT to a user’s organization. Characterized as following:

• Confidentiality (CR)
• Integrity (IR)
• Availability (AR)

2. Modified base metrics – It helps the adjustment of base metrics in accordance with the modification that is already present in the analyst’s environment.

Learn How to Advance Your Current Cybersecurity

See how you can improve your current cybersecurity efforts and create a layered, proactive security portfolio with this guide, The Proactive Approach to Advancing Your Security Maturity.