(7) CVSS Common Vulnerability Scoring System

Question 1

What is the Common Vulnerability Scoring System (CVSS)?

Answer 1

The CVSS is an industry standard for assessing the severity of security vulnerabilities.

It provides a technique for scoring each vulnerability on a variety of measures.

Each measure has a descriptive rating and a score

Question 2

What do the first four measures of the Common Vulnerability Scoring System (CVSS) evaluate, and what do the last three evaluate? How about the eighth (and final) one?

Answer 2

The first four measures of the CVSS evaluate the exploitability of the vulnerability, while the last three evaluate the impact of the vulnerability.

The eight is about scope.

Question 3

In the Common Vulnerability Scoring System (CVSS), what is the Attack Vector (AV)?

Answer 3

The AV metric describes how an attacker would exploit the vulnerability and is assigned according to various values which are Physical (P), Local (L), Adjacent Network (A), Network (N)

Question 4

Within the Common Vulnerability Scoring System (CVSS), describe the attack complexity metric

Answer 4

The attack complexity metric describes the difficulty of exploiting the vulnerability and is assigned according to two values, which are High (H), and Low (L)

Question 5

Within the Common Vulnerability Scoring System (CVSS), what is the Privileges Required (PR) Metric?

Answer 5

The PR metric describes the type of account access that an attack would need to take advantage of a vulnerability and is assigned to three values, High (H), Low (L), and None (N)

Question 6

Within the Common Vulnerability Scoring System (CVSS), describe the User Interaction Metric

Answer 6

The User Interaction (UI) metric describes if the attacker needs to involve another person in the attack. It is assigned according to two values, None (N), and Required (R)

Question 7

Within the Common Vulnerability Scoring System (CVSS), describe the Integrity Metric

Answer 7

The Integrity metric describes the type of information that might happen if an attacker exploits the vulnerability. It is assigned according to these values, None (N), Low (L), High (H)

Question 8

Within the Common Vulnerability Scoring System, describe the Availability Metric

Answer 8

The availability metric describes the type of disruption that might occur if an attacker succeeds in what they are trying to do. It is assigned based on these values, None (N), Low (L), High (H)

Question 9

within the Common Vulnerability Scoring System (CVSS), describe the Scope Metric

Answer 9

The Scope Metric describes if the vulnerability can affect system components beyond the scope of the vulnerability. The metric is assigned according to these values, Unchanged (U), and Changed (C)

Question 10

Within the Common Vulnerability Scoring System (CVSS), what is the CVSS vector?

Answer 10

The CVSS vector uses a single line format to refer the ratings of a vulnerability on all CVSS metrics.

The vector contains nine components, Attack Vector, Attack Complexity, Privileges Required, User interaction, Scope, Confidentiality, Integrity, Availability

Question 11

Within the Common Vulnerability Scoring System (CVSS), what is the CVSS base score?

Answer 11

The CVSS base score is a single number representing the overall risk posed by the vulnerability.

To get the base score, one must calculate the exploitability score, impact score, and impact function.

Question 12

Within the Common Vulnerability Scoring System, what is the Impact Sub Score (ISS)?

Answer 12

The metric summarizes the three impact metrics using the formula

ISS = 1 - [(1 - Confidentiality) x (1 - Integrity) x (1 - Availability)]

Question 13

within the Common Vulnerability Scoring System (CVSS), when calculating the impact score, what value must we take into account?

Answer 13

To calculate the impact score from the impact sub score, we have to take the value of the scope metric into consideration.

If the scope metric is unchanged, then the ISS is multiplied by 6.42.

Impact = X.XX * ISS

Question 14

Considering the Common Vulnerability Scoring System (CVSS), when calculating the impact sub score, if the scope metric is changed, how are the calculations performed?

Answer 14

While calculating the impact sub score, If the scope metric is changed, the formula is:

Impact = X.XX x (ISS - 0.029) - 3.25 x (ISS - 0.02)^15

Question 15

Within the Common Vulnerability Scoring System (CVSS), what is exploitability and weaponization?

Answer 15

Exploitability is a measure of how likely it is that an attacker will use a vulnerability to gain access to a system.

Weaponization is the ability of an attacker to make an exploit that leverages a vulnerability.

Question 16

Within the Common Vulnerability Scoring System (CVSS), how is exploitability calculated?

Answer 16

Exploitability is calculated with this formula:

Exploitability = 8.22 x AttackVector X AttackComplexity X PrivilegesRequired X UserInteraction

Question 17

Considering the Common Vulnerability Scoring System (CVSS), when trying to calculate the base score, if the impact is 0, what is the base score?

Also, is the scope metric is unchanged, how is the base score calculated?

Answer 17

If the impact is 0, so is the base score

If the scope metric is not changed, the base score is calculated by adding together the impact and exploitability scores and multiplying the result by 1.08

Question 18

Considering the Common Vulnerability Scoring System (CVSS), when calculating the base score, if the scope metric is changed, how is the base score calculated?
Also, what is the highest possible base score?

Answer 18

If the scope metric is changed, the base score is calculated by adding together the impact and exploitability scores and then multiplying the result by 1.08

The highest possible base score is 10, if the score you calculate is more than 10, set the score to 10

Question 19

What is the Common Vulnerability Scoring System Qualitative Severity Rating Scale (CVSS Qualitative Severity Scale)?

Answer 19

The CVSS Qualitative Severity Scale further summarizes the CVSS results by using risk categories instead of numeric risk ratings

Question 20

Considering the Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating Scale, what are the five categories that can be used as a result of the calculations?

Answer 20

0 = None

0.1-3.9 = Low

4.0-6.9 = Medium

7.0-8.9 = High

9.0-10.0 - Critical