You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<pclass="admonition-title">Vendor data is subject to change</p>
5294
5294
<p>This data is subject to change as vendors update their solutions. Check vendor documentation.</p>
5295
5295
</div>
5296
+
<h2id="vendors-microsoft_exploitability_index-adopting-the-cwe-standard-for-microsoft-cves">Adopting the <abbrtitle="CWE Common Weakness Enumeration">CWE</abbr> standard for Microsoft CVEs<aclass="headerlink" href="#vendors-microsoft_exploitability_index-adopting-the-cwe-standard-for-microsoft-cves" title="Permanent link">¶</a></h2>
5297
+
<p>Per <ahref="https://msrc.microsoft.com/blog/2024/04/toward-greater-transparency-adopting-the-cwe-standard-for-microsoft-cves/">Toward greater transparency: Adopting the <abbrtitle="CWE Common Weakness Enumeration">CWE</abbr> standard for Microsoft CVEs April 8, 2024</a>, Microsoft is adopting the <abbrtitle="CWE Common Weakness Enumeration">CWE</abbr> standard for Microsoft CVEs.</p>
5298
+
<p>Taking <ahref="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29990">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29990</a> as an example:</p>
5299
+
<ol>
5300
+
<li><abbrtitle="CWE Common Weakness Enumeration">CWE</abbr> is now being used per article above. <imgalt="👏" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f44f.svg" title=":clap:" /></li>
5301
+
<li>Microsoft Exploitability Index "MSEI" already included Exploitability data - but now they're putting it (and other info) in the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Temporal score metrics also. <imgalt="👏" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f44f.svg" title=":clap:" /><ol>
5302
+
<li>"Exploit Code Maturity: Proof Of Concept"</li>
5303
+
</ol>
5304
+
</li>
5305
+
<li>The MSEI Impact is more fine grained than <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Confidentiality, Integrity, Availability Impact and co-exists with it. <imgalt="👏" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f44f.svg" title=":clap:" /><ol>
5306
+
<li>"Elevation of Privilege" with an associated "Max Severity: Important"</li>
5307
+
</ol>
5308
+
</li>
5309
+
</ol>
5310
+
<p>Unfortunately, the data for 2. and 3. above is not in the NIST <abbrtitle="National Vulnerability Database">NVD</abbr>: <ahref="https://nvd.nist.gov/vuln/detail/CVE-2024-2990">https://nvd.nist.gov/vuln/detail/CVE-2024-2990</a> 😔</p>
<li>In this case, the population of "Exploitation more likely" is relatively small compared to "Exploitation less likely" plus "Exploitation unlikely".</li>
5303
5323
</ol>
5304
5324
</li>
5325
+
<li>Microsoft is setting a great example by using CWEs, but also publishing the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Temporal data (including Exploit Code Maturity), and more meaningful Impact data than <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> supports. <imgalt="👏" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f44f.svg" title=":clap:" /></li>
<pclass="admonition-title">Vendor data is subject to change</p>
1592
1610
<p>This data is subject to change as vendors update their solutions. Check vendor documentation.</p>
1593
1611
</div>
1612
+
<h2id="adopting-the-cwe-standard-for-microsoft-cves">Adopting the <abbrtitle="CWE Common Weakness Enumeration">CWE</abbr> standard for Microsoft CVEs<aclass="headerlink" href="#adopting-the-cwe-standard-for-microsoft-cves" title="Permanent link">¶</a></h2>
1613
+
<p>Per <ahref="https://msrc.microsoft.com/blog/2024/04/toward-greater-transparency-adopting-the-cwe-standard-for-microsoft-cves/">Toward greater transparency: Adopting the <abbrtitle="CWE Common Weakness Enumeration">CWE</abbr> standard for Microsoft CVEs April 8, 2024</a>, Microsoft is adopting the <abbrtitle="CWE Common Weakness Enumeration">CWE</abbr> standard for Microsoft CVEs.</p>
1614
+
<p>Taking <ahref="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29990">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29990</a> as an example:</p>
1615
+
<ol>
1616
+
<li><abbrtitle="CWE Common Weakness Enumeration">CWE</abbr> is now being used per article above. <imgalt="👏" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f44f.svg" title=":clap:" /></li>
1617
+
<li>Microsoft Exploitability Index "MSEI" already included Exploitability data - but now they're putting it (and other info) in the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Temporal score metrics also. <imgalt="👏" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f44f.svg" title=":clap:" /><ol>
1618
+
<li>"Exploit Code Maturity: Proof Of Concept"</li>
1619
+
</ol>
1620
+
</li>
1621
+
<li>The MSEI Impact is more fine grained than <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Confidentiality, Integrity, Availability Impact and co-exists with it. <imgalt="👏" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f44f.svg" title=":clap:" /><ol>
1622
+
<li>"Elevation of Privilege" with an associated "Max Severity: Important"</li>
1623
+
</ol>
1624
+
</li>
1625
+
</ol>
1626
+
<p>Unfortunately, the data for 2. and 3. above is not in the NIST <abbrtitle="National Vulnerability Database">NVD</abbr>: <ahref="https://nvd.nist.gov/vuln/detail/CVE-2024-2990">https://nvd.nist.gov/vuln/detail/CVE-2024-2990</a> 😔</p>
<li>In this case, the population of "Exploitation more likely" is relatively small compared to "Exploitation less likely" plus "Exploitation unlikely".</li>
1601
1639
</ol>
1602
1640
</li>
1641
+
<li>Microsoft is setting a great example by using CWEs, but also publishing the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Temporal data (including Exploit Code Maturity), and more meaningful Impact data than <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> supports. <imgalt="👏" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f44f.svg" title=":clap:" /></li>
0 commit comments