Prioritizing Vulnerabilities with CVSS Scoring

Overview

The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (released November 2023) introduces refined metrics for more accurate scoring. This skill covers calculating CVSS scores, interpreting vector strings, and using CVSS alongside contextual factors like EPSS and CISA KEV for effective vulnerability prioritization.

When to Use

• When managing security operations that require prioritizing vulnerabilities with cvss scoring
• When improving security program maturity and operational processes
• When establishing standardized procedures for security team workflows
• When integrating threat intelligence or vulnerability data into operations

Prerequisites

• Understanding of common vulnerability types (buffer overflow, injection, XSS, etc.)
• Familiarity with networking concepts (attack vectors, protocols)
• Access to NVD (National Vulnerability Database) for CVE lookups
• Vulnerability scan results requiring prioritization

Core Concepts

CVSS v4.0 Metric Groups

1. Base Metrics (Intrinsic Severity)

Represent the inherent characteristics of a vulnerability:

Exploitability Metrics:

• Attack Vector (AV): Network (N), Adjacent (A), Local (L), Physical (P)
• Attack Complexity (AC): Low (L), High (H)
• Attack Requirements (AT): None (N), Present (P) - NEW in v4.0
• Privileges Required (PR): None (N), Low (L), High (H)
• User Interaction (UI): None (N), Passive (P), Active (A) - Expanded in v4.0

Impact Metrics (Vulnerable System):

• Confidentiality (VC): None (N), Low (L), High (H)
• Integrity (VI): None (N), Low (L), High (H)
• Availability (VA): None (N), Low (L), High (H)

Impact Metrics (Subsequent System):

• Confidentiality (SC): None (N), Low (L), High (H)
• Integrity (SI): None (N), Low (L), High (H)
• Availability (SA): None (N), Low (L), High (H)

2. Threat Metrics (Dynamic Context)

• Exploit Maturity (E): Attacked (A), POC (P), Unreported (U)

3. Environmental Metrics (Organization-Specific)

Modified versions of base metrics reflecting local deployment context, plus:

• Confidentiality Requirement (CR): High (H), Medium (M), Low (L)
• Integrity Requirement (IR): High (H), Medium (M), Low (L)
• Availability Requirement (AR): High (H), Medium (M), Low (L)

4. Supplemental Metrics (Advisory Information)

• Safety (S): Present (P), Negligible (X)
• Automatable (AU): Yes (Y), No (N)
• Recovery (R): Automatic (A), User (U), Irrecoverable (I)
• Value Density (V): Diffuse (D), Concentrated (C)
• Vulnerability Response Effort (RE): Low (L), Moderate (M), High (H)
• Provider Urgency (U): Red, Amber, Green, Clear

CVSS v4.0 Severity Ratings

CVSS v4.0 Vector String Format

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

This example represents a network-exploitable vulnerability requiring no privileges, no user interaction, no attack requirements, with high impact on confidentiality, integrity, and availability of the vulnerable system.

Workflow

Step 1: Assess Base Metrics

For each vulnerability, evaluate:

Example: CVE-2024-3094 (XZ Utils Backdoor)

Attack Vector:        Network (N)     - Exploitable over network
Attack Complexity:    High (H)        - Specific conditions required
Attack Requirements:  Present (P)     - Specific build/config needed
Privileges Required:  None (N)        - No authentication needed
User Interaction:     None (N)        - No victim action needed

Vulnerable System Impact:
  Confidentiality:    High (H)        - Complete access to SSH keys
  Integrity:          High (H)        - Arbitrary code execution
  Availability:       High (H)        - Full system compromise

Subsequent System Impact:
  Confidentiality:    High (H)        - Lateral movement possible
  Integrity:          High (H)        - Network-wide compromise
  Availability:       None (N)        - No downstream availability impact

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Step 2: Apply Threat Intelligence Context

Enrich CVSS with real-world threat data:

…