Common Vulnerability Scoring System (CVSS)

The Common Vulnerabilities and Exposures list gives us an idea what vulnerabilities are out there, but which ones should we focus on? We need some sort of scoring system, and that's where the Common Vulnerability Scoring System, or CVSS, comes into play. It's a way that we can score these different vulnerabilities and understand.

This is a vulnerability record on the CVE, the Common Vulnerabilities and Exposures list, of a WordPress vulnerability, and here we have a score right here. It's 8.5. But what does this 8.5 mean, how do we derive this, and is it 8.5 for our network? Let's answer that with this CVSS.

Why we need to prioritize

Let's say we do a vulnerability scan on our network and we discover some sort of issue. Of course we're going to want to remediate those issues, but which ones do we tackle first? If we have a lot of vulnerabilities and they're more complex in the way we have to solve them, we may have more work than we know what to do with, and so we're going to have to prioritize which ones we are going to tackle first. What we may need to do is some sort of assessment on these vulnerabilities to figure out what is the importance with these vulnerabilities and what order do we tackle them in.

We have a scoring system that allows us to score what is the priority of these different vulnerabilities. The Common Vulnerability Scoring System gives us several factors that we would score each one of these vulnerabilities on, so that way we can assess what is the importance of these, from a scoring of zero all the way to 10 - 10 being really critical and zero being not really a concern at all.

Really, when you render down the scoring, it has to deal with how much risk these vulnerabilities pose, which is probability times impact, although how we rate these gets a little more granular than that. The probability takes into account the attack vector, the attack complexity, the privilege required, the user interaction and the scope of it. It also takes into consideration the risk impact from a confidentiality, integrity and availability standpoint.

Now, even though these vulnerabilities have a scoring, this scoring may or may not apply to our specific scenario, so it's good to know how to score these different vulnerabilities on our network.

Opening the calculator

Let's go ahead and open up a new tab here, and I'm just going to type in CVSS and hit enter. Here we've got the Common Vulnerability Scoring System, so I'm going to click on that to get to this first.org site, and we have now information on the Common Vulnerability Scoring System. This is just some information on it, but it also has this link to the calculator, so let's click the calculator and now let's play around with the calculator to see what kind of scoring looks like.

Up here at the top we see this CVSS version 4.0 score, and we've got zero out of none here. So this is going to be our score, and as we select different aspects to this it's going to start filling in a score up here. Now we've got a score of one, and we can click these different impacts here and now we've got a 1.8. As I mentioned, we have things like the attack vector, the complexity, the attack requirements, the things I just mentioned, also confidentiality, integrity and availability. It also has this base metric as well as some supplemental metrics that we can add on to it.

Let's just take a look at this base metric and talk about what some of the base metric looks like. To start over, what I'm going to do is click on reset, and then we're going to start out with this attack vector. If I hold my question mark over this, it actually tells us what the attack vector meaning is.

Now if I were to change some of these settings right now, it's not going to do anything, because there's no vulnerable system impact metric down here. So what I'm going to do is just select confidentiality is low impact, so we have a number here. Now what I can do is I can find out what the actual number is going to be by clicking these different elements here.

Attack vector

So let's talk about attack vector. What is the attack vector? The attack vector is going to be, where does the attacker need to be at? Do they need to have physical access to the equipment? Let's say there's some sort of firewall maybe, and there's a vulnerability on the firewall, and so do they need to physically have access to this firewall in order to exploit it? Well, if that's the case, we're going to get our lowest rating right there.

Or maybe they don't need physical access, maybe they just need logical access, so they need to be able to logically get to that firewall. Maybe they're on the network, maybe it's an insider threat. Then we click on local, and we can see that that value goes up, that the rating becomes higher - it's a 5.1 now.

Or maybe it's adjacent, so they don't have to be on the network that hits that exact firewall, but maybe they need to be somewhere within the company boundaries from a logical perspective, maybe one of the other devices, and then be able to leverage that to get access to it. Well now, that's an adjacent network right there.

Or perhaps they could be remote, they could be anywhere in the world and gain access to this firewall. Well now, that's just any network connectivity they have, and so obviously that's going to be the highest concern there. So in this scenario, let's just say we can be on an adjacent network, that we don't have to be a network that directly has access to this firewall, but we have to be somewhere within the company's adjacent systems in order to gain access to the firewall.

Attack complexity and attack requirements

Next we have the attack complexity. This is how complex, how many steps an attacker would have to take in order to exploit this vulnerability. Do they have to take a lot of steps and be a little more knowledgeable about how to exploit this? Then we'd have a high. By having this barrier, where they have to have a lot of knowledge about it, it makes it so that not just anybody is able to exploit this, versus a low setting, which means more that just anybody could come in with less knowledge and be able to exploit it.

Then there's also this attack requirements, that there are certain conditions that need to be met in order to exploit it - they have to have something set up in a certain way. So if it has to be set up in a certain way, then we would select that it's present, which means that this would drop, because not everybody's conditions would be set up the same way, and so the likelihood becomes less. But let's say it doesn't require any specific setup: then we would click on none, and then it's a higher rating right there.

So let's say that there is some sort of condition that needs to be set up on it, so it's present. But the thing is, we don't know if it's set up that way on our network or not. So this is one thing that we could customize with this, whether it's none or present, to get a more dialed in view for our network and what it looks like on our network.

Privilege required and user interaction

The next one on here is privilege required. Do they need extra privileges in order for them to use this vulnerability? It could be that they don't need any extra privileges, that they just need to have access to the machine but they don't necessarily need to have any credentials to get onto the machine, so that would be none. Or maybe they just need to be a user on the machine, and that would be low. Or maybe they need a privilege level account, and that would be high. So we would select which one this is. If it's high, then we've got a two there; if it's low, we've got a 2.1; and if it's none, then 2.3, because it's more dangerous that they don't even have to have any kind of credentials to get onto this machine.

The user interaction depends on if they need another user or somebody else to carry out this attack, or can it be just them. If it's just them, we would select none - obviously this would be the most concerning here. If it does need another user, that would be passive or active depending on the level of involvement they need to have in this vulnerability. Passive just means that they have a small role, versus active a larger role. Obviously the larger role that somebody else has in this exploit is going to decrease the likelihood that this is going to happen, so decrease our score here, versus if they go for a none, then it's a 2.3, because then they don't need anybody extra to carry out this type of attack.

Confidentiality, integrity and availability

Then we can rate it off of confidentiality, integrity and availability. What's going to be the impact if this does get compromised, if something were to happen? We would rate each one of these categories. Let's use the firewall as an example here. If the firewall has been compromised, maybe they can't really do anything on the firewall except for view some of the packets that go across it. Well, that's a confidentiality concern, and so perhaps we're concerned about the information that's traversing across it, so maybe it's low or maybe it's high, and we'd select high, and notice that changes our score there.

We've got the integrity. Maybe now what they can do is not only affect what they're seeing but also affect what the data actually is, so then we could select the level from that perspective, and now notice we've increased it. Or maybe that's low. And then also the availability - can they bring the system actually down or not? And so we select low or high from that perspective.

Now notice we not only evaluate the vulnerable system impact, so in this case we're talking about the firewall, so we could evaluate it from the firewall's perspective. But maybe there's other systems that, once they leverage this firewall, they're able to get into, other systems like the file server. So now we have a confidentiality, integrity and availability concern over a file server, and so we evaluate any subsequent system impacts based off of this vulnerability.

The vector string and severity

There are other measurements here. We're not going to dig down deep into every single one of them, but this is the primary one, the base metric here. And what this is right here is the vector. This is the single line that essentially is like a little code for what we've selected here. So if we want to create a copy of this, so that way we have a record of it, all we'd need to do is click here, and now we have a record, or paste it in whatever documentation we have, and now we have a record of how we came up with this 7.4 score.

Now we also see a severity level here, so this is a severity level of high. And what we could do is we could change some of the settings here, and now we see that it's critical. So we've got critical, we've got high; we could change some of these to make it medium, or we could change some of these aspects to it to have a low. So we see how critical it is, the severity of it, as to whether we're going to tackle this or not.

So if we take a look at one of our vulnerabilities here, we have this vector string here. That vector string lets us know what the vector is, and what we could do is we could emulate that here in the CVSS scoring calculator, but make changes for our specific network. And so now we're not stuck with the score and severity that it has for this vulnerability.