Agentless security for your infrastructure and applications - to build faster, more securely and in a fraction of the operational cost of other solutions
The common vulnerability scoring system (CVSS) is a way to assign scores to vulnerabilities on the basis of their principal characteristics. This score indicates the severity of a vulnerability and on that basis, it can be categorized into low, medium, high, and critical severity which can be used by the organization to prioritize the vulnerabilities present in the system.
CVSS has two versions of the scoring system CVSS2 and CVSS3, the cvss2 was released in the year 2007 and had a scoring range of 0 - 10 with three severity levels low, medium, and high whereas cvss3 was launched in the year 2015 having a scoring range of 0 - 10 with 5 severity levels none, low, medium, high, and critical. The Base, Temporal, and Environmental metric groups all remained the same. However, there were some changes within the Base and Environmental groups to find out the accurate scores of the vulnerability.
The CVSS score ranges from 0.0 to 10.0, where 1.0 is considered as least severe and 10.0 is the most severe. Mapping of CVSS score with qualitative ratings:
Base Score range Severity
0.1 – 3.9 Low
4.0 – 6.9 Medium
7.0 – 8.9 High
9.0 – 10.0 Critical
A CVSS score is derived from three sets of metrics Base, Terminal, and Environmental. These three metrics cover the different characteristics of a vulnerability, its impact, and environmental tolerance over time.
The base metrics represent the base score ranging from 0 - 10 and the inherent characteristics of a vulnerability that is, these characteristics don’t change over time. It is made up of two sets of Metrics:
The temporal Metrics represent the characteristics of a vulnerability that change over time. Additionally, it contains the Report Confidence metric, which measures the degree of assurance in the existence of the vulnerability. It consists of three metrics groups:
The environmental metrics represent the characteristics of a vulnerability that are relevant and have an impact on a particular user’s environment. Environmental metrics categories include:
For example, consider a vulnerability having a CVSS score of 6.5 and having a vector:
The above vector value indicates:
AV: L - (Attack Vector) It means that the vulnerability is exploitable by local access.
AC: L - (Attack complexity) This vector value indicates that a specialized access condition does not exist.
PR: L - (Privileges required) It indicates that the attacker is authorized with privileges that provide basic user capabilities.
UI: N - (User interaction) The vulnerable system can be exploited without interaction from any user.
S: U - (Scope) An exploited vulnerability can only affect resources managed by the same authority.
C: H - (Confidentiality impact) There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker.
I: H - (Integrity impact) There is a total loss of integrity.
A: H - (Availability impact) Loss of availability means the attacker is able to fully deny access to resources in the impacted component.
E: U - (Exploit code maturity) No exploit code is available, or an exploit is entirely theoretical.
RL: O - (Remediation Level) A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
RC: R - (Report Confidence) Reasonable confidence exists, however, that the big is reproducible and at least one impact is able to be verified.
CR: H - (Confidentiality requirement) Loss of confidentiality is likely to have a catastrophic adverse effect on the organization.
IR: H - (Integrity requirement) Loss of integrity is likely to have a catastrophic adverse effect on the organization.
AR: L - (Availability requirement) Loss of availability is likely to have a limited adverse effect on the organization.
Most cybersecurity companies use CVSS to prioritize their vulnerability but it is not the best and most accurate metric and due to this they waste the majority of their time on vulnerability which is not that risky. This problem can be solved by using the EPSS scoring system as it reduces the 85% of efforts of the security team compared to the CVSS scoring system while obtaining the same result. You can learn more about the EPSS scoring system in our next blog.
SecOps Solution is an award-winning agent-less Full-stack Vulnerability and Patch Management Platform that helps organizations identify, prioritize and remediate security vulnerabilities and misconfigurations in seconds.
To schedule a demo, just pick a slot that is most convenient for you.