You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Count of CVEs at or above CVSS Base Score and CVSS Base and Threat Score
1378
+
</span>
1379
+
</a>
1380
+
1381
1381
</li>
1382
1382
1383
1383
<liclass="md-nav__item">
@@ -1420,7 +1420,7 @@ <h1 id="common-vulnerability-scoring-system-cvss">Common Vulnerability Scoring S
1420
1420
<li><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity Rating</li>
1421
1421
<li><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Confidentiality, Integrity, Availability Impacts</li>
<p><imgalt="🧑💻" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f9d1-200d-1f4bb.svg" title=":technologist:" /><ahref="https://github.com/RiskBasedPrioritization/RiskBasedPrioritizationAnalysis/blob/main/analysis/cisa_kev_epss_cvss.ipynb">Source Code</a>and <ahref="https://github.com/RiskBasedPrioritization/RiskBasedPrioritizationAnalysis/blob/main/analysis/cvss-bt.ipynb"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base vs <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base & Threat Source Code</a></p>
1424
1424
</div>
1425
1425
<h2id="cvss-severity-rating-scale"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity Rating Scale<aclass="headerlink" href="#cvss-severity-rating-scale" title="Permanent link">¶</a></h2>
1426
1426
<divclass="admonition quote">
@@ -1456,8 +1456,9 @@ <h2 id="cvss-severity-rating-scale"><abbr title="Common Vulnerability Scoring Sy
1456
1456
</div>
1457
1457
<divclass="admonition tip">
1458
1458
<pclass="admonition-title">Don't use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores alone to assess risk.</p>
1459
-
<p>Many organizations use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores alone to assess risk despite repeated guidance against this.<br/>
1460
-
<strong>A Critical or High <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity is not the same as a Critical or High <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr>. There's a >10x difference in counts of CVEs</strong> for these 2 groups:</p>
1459
+
<p>Many organizations use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores alone to assess risk despite repeated guidance against this. </p>
1460
+
<p><strong>A Critical or High <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity is not the same as a Critical or High <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr>.</strong></p>
1461
+
<p><strong>There's a ~10x difference in counts of CVEs</strong> for these 2 groups:</p>
1461
1462
<ul>
1462
1463
<li><strong>>50% of CVEs are ranked Critical or High <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> rating (<abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> score 7+)</strong></li>
1463
1464
<li><strong>~~5% of CVEs are exploited in the wild</strong></li>
<h2id="count-of-cves-at-or-above-cvss-base-score">Count of CVEs at or above <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score<aclass="headerlink" href="#count-of-cves-at-or-above-cvss-base-score" title="Permanent link">¶</a></h2>
<figcaption> How many CVEs are at/above a given CVSS score? <br>
1537
-
The continuous line is a polynomial regression of order 2.
1538
-
</figcaption>
1539
-
</figure>
1540
1533
<h2id="cvss-exploit-maturity"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Exploit Maturity<aclass="headerlink" href="#cvss-exploit-maturity" title="Permanent link">¶</a></h2>
1541
1534
<p>In addition to the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Metrics which are commonly used, <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> supports other Metrics, including Threat Metrics.</p>
1542
1535
<divclass="admonition quote">
@@ -1554,6 +1547,36 @@ <h3 id="cvss-v31"><abbr title="Common Vulnerability Scoring System Standard. A f
<li><ahref="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">Not Defined (X): 9.8</a> results in the same score as <ahref="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H">High (H): 9.8</a></li>
1556
1549
</ul>
1550
+
<divclass="admonition tip">
1551
+
<pclass="admonition-title">An example project that enriches <abbrtitle="National Vulnerability Database">NVD</abbr><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores to include Temporal & Threat Metrics</p>
1552
+
<p>"<ahref="https://github.com/t0sche/cvss-bt">Enriching the <abbrtitle="National Vulnerability Database">NVD</abbr><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores to include Temporal & Threat Metrics</a>" is an example project
1553
+
where the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Exploit Code Maturity/Exploitability (E) Temporal Metric
1554
+
is continuously updated.</p>
1555
+
<ul>
1556
+
<li>Fetches <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> scores every morning</li>
1557
+
<li>Fetches <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores from <abbrtitle="National Vulnerability Database">NVD</abbr> if there are new <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> scores.</li>
1558
+
<li>Calculates the Exploit Code Maturity/Exploitability (E) Metric when
1559
+
new data is found.</li>
1560
+
<li>Provides a resulting <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>-BT score for each <abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr></li>
1561
+
</ul>
1562
+
<p>It uses an <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> threshold of 36% as the threshold for High for Exploit Code Maturity/Exploitability (E).</p>
1563
+
</div>
1564
+
<h3id="count-of-cves-at-or-above-cvss-base-score-and-cvss-base-and-threat-score">Count of CVEs at or above <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score and <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base and Threat Score<aclass="headerlink" href="#count-of-cves-at-or-above-cvss-base-score-and-cvss-base-and-threat-score" title="Permanent link">¶</a></h3>
1565
+
<p>The data from "<ahref="https://github.com/t0sche/cvss-bt">Enriching the <abbrtitle="National Vulnerability Database">NVD</abbr><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores to include Temporal & Threat Metrics</a>" is used.</p>
1566
+
<p><imgalt="🧑💻" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/1f9d1-200d-1f4bb.svg" title=":technologist:" /><ahref="https://github.com/RiskBasedPrioritization/RiskBasedPrioritizationAnalysis/blob/main/analysis/cvss-bt.ipynb"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base vs <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base & Threat Source Code</a></p>
<figcaption> How many CVEs are at/above a given CVSS score? <br>
1571
+
The continuous line is a polynomial regression of order 2.
1572
+
</figcaption>
1573
+
</figure>
1574
+
<divclass="admonition observations">
1575
+
<pclass="admonition-title">Observations</p>
1576
+
<ol>
1577
+
<li>There is a significant difference in the count of CVEs above <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Score ~9 for <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base, and <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base and Threat. In other words, for <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base and Threat there's a lot less CVEs above a score of ~9.</li>
1578
+
</ol>
1579
+
</div>
1557
1580
<h3id="cvss-v40"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> v4.0<aclass="headerlink" href="#cvss-v40" title="Permanent link">¶</a></h3>
1558
1581
<p>The Threat Metrics - Exploit Maturity (E) value causes the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> v4.0 Score to vary slightly</p>
1559
1582
<ul>
@@ -1570,20 +1593,6 @@ <h3 id="cvss-v40"><abbr title="Common Vulnerability Scoring System Standard. A f
1570
1593
<p>There's a big difference in likelihood of exploitation, and associated populations of CVEs, in Attacked vs POC.</p>
1571
1594
<p>However, the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Score changes only slightly between these - and that slight variation in score does not significantly change the counts of CVEs above the score per <ahref="#count-of-cves-at-or-above-cvss-base-score">Count of CVEs at or above <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score</a>.</p>
1572
1595
<p><strong>The convenience of a single <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> score comes with the cost of not being able to understand or differentiate between the risk factors from the score, and not being able to prioritize effectively using the score.</strong></p>
1573
-
<divclass="admonition tip">
1574
-
<pclass="admonition-title">An example project that enriches <abbrtitle="National Vulnerability Database">NVD</abbr><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores to include Temporal & Threat Metrics</p>
1575
-
<p>"<ahref="https://github.com/t0sche/cvss-bt">Enriching the <abbrtitle="National Vulnerability Database">NVD</abbr><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores to include Temporal & Threat Metrics</a>" is an example project
1576
-
where the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Exploit Code Maturity/Exploitability (E) Temporal Metric
1577
-
is continuously updated.</p>
1578
-
<ul>
1579
-
<li>Fetches <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> scores every morning</li>
1580
-
<li>Fetches <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores from <abbrtitle="National Vulnerability Database">NVD</abbr> if there are new <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> scores.</li>
1581
-
<li>Calculates the Exploit Code Maturity/Exploitability (E) Metric when
1582
-
new data is found.</li>
1583
-
<li>Provides a resulting <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>-BT score for each <abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr></li>
1584
-
</ul>
1585
-
<p>It uses an <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> threshold of 36% as the threshold for High for Exploit Code Maturity/Exploitability (E).</p>
0 commit comments