📖 What is Common Vulnerability Scoring System (CVSS)?
The Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of software vulnerabilities. It provides a numerical score reflecting the ease of exploitation and the potential impact on confidentiality, integrity, and availability.
"Pay attention to the difference between Base, Temporal, and Environmental scores; the Base score is the most common metric you will encounter in vulnerability reports."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Common Vulnerability Scoring System (CVSS)?
- ▸ The Base Score represents intrinsic qualities of a vulnerability, including attack vector, complexity, and the impact on confidentiality, integrity, and availability.
- ▸ Temporal Scores account for factors that change over time, such as the availability of an official patch or the maturity of public exploit code.
- ▸ Environmental Scores allow organizations to customize the severity based on the importance of the affected asset and the presence of existing security controls.
- ▸ The CIA triad serves as the foundation for impact metrics, measuring how much a vulnerability compromises the secrecy, accuracy, or accessibility of data.
- ▸ Numerical score ranges categorize vulnerabilities into Low, Medium, High, and Critical levels, which penetration testers use to prioritize remediation efforts.
🎯 How does Common Vulnerability Scoring System (CVSS) appear on the PT0-002 Exam?
You may be asked to prioritize a list of discovered vulnerabilities by comparing their Base scores to determine which pose the highest immediate risk to the organization.
A scenario might describe a critical vulnerability on a decommissioned or isolated server; you must identify how the Environmental score reduces the actual risk level.
Expect questions requiring you to analyze a CVSS vector string to determine if a vulnerability requires user interaction or specific privileges to be successfully exploited.
❓ Frequently Asked Questions
Why should a penetration tester consider the Environmental score instead of just the Base score?
The Base score represents a vulnerability in a vacuum. The Environmental score allows a tester to adjust the severity based on the asset's actual business value and the specific mitigating controls present in the target environment.
What is the significance of the 'Scope' metric introduced in CVSS v3?
The Scope metric determines if a vulnerability in one component can impact resources in a different security authority, such as a virtual machine escape affecting the underlying hypervisor.