Common Vulnerabilities and Exposures (CVE)
Vulnerability identification system
The goal is to provide a standardized method for naming and describing security vulnerabilities, facilitating collaboration and information sharing between different security solutions and experts.
Example
CVE-ID: CVE-2023-32784
prefix-year-sequential number
The sequential number is a unique identifier assigned to a specific security vulnerability within a given calendar year.
Common Vulnerability Scoring System (CVSS)
Quantification of security vulnerabilities
CVSS is usually used in combination with CVE.
Example
Weak point: CVE-2023-32784
Base Score 7.5 Height
/ / / / CVSS-Vektor: \ \ \ \
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Version der Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector (AV)
Network (N)
Adjacent network (A)
Local (L)
Physical (P)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Complexity (AC)
Low (L)
High (H)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Permissions (PR)
None (N)
Low (L)(standard login credentials)
High (H) (admin rights)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Userinteraktions (UI)
None (N)
Required (R) (User must, for example, click a link)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Scope (S)
Unchanged (U)
Changed (C)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Confidentiality (C)
None (N)
Low (L)
High (H)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Integrity (I)
None (N)
Low (L)
High (H)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Availability (A)
None (N)
Low (L)
High (H)
( C ) confidentiality
( I ) integrity
( A ) Availability
| Score | Criticality |
|---|---|
| 0 | None |
| 0.1-3.9 | Low |
| 4.0-6.9 | Middle |
| 7.0-8.9 | High |
| 9.0-10.0 | Critical |