CVSS v2 Vulnerability Metrics

CVSS v2 Base Metrics

• Access Vector (AV) values indicate how an attacker can access the system.
  • Local (L) access requires system access (0.395 points), such as malware via USB.
  • Adjacent Network (A) access is within the same network segment (0.646 points), like ARP spoofing on Wi-Fi.
  • Network (N) access is remote (1.0 point), such as RCE in a web server.
• Access Complexity (AC) describes the difficulty of exploitation.
  • High (H) complexity requires special conditions (0.35 points), like specific software versions.
  • Medium (M) complexity is somewhat difficult under normal conditions (0.61 points), such as SQL Injection.
  • Low (L) complexity is easily executed (0.71 points), like a Metasploit exploit.
• Authentication (Au) specifies the number of authentications needed.
  • Multiple (M) requires several authentications (0.45 points), like VPN and SSH.
  • Single (S) requires one authentication (0.56 points), like a web admin panel login.
  • None (N) requires no authentication (0.704 points), like an open FTP server.
• Confidentiality (C) details the data exposure level.
  • None (N) means no data exposure (0.0 points).
  • Partial (P) indicates some data exposure (0.275 points), like leaked usernames.
  • Complete (C) means all sensitive data is exposed (0.660 points), like a full database dump.
• Integrity (I) specifies the extent of data modification.
  • None (N) means no data modification (0.0 points).
  • Partial (P) indicates some data modification (0.275 points), like low-privilege file edits.
  • Complete (C) means full system control (0.660 points), like root access.
• Availability (A) indicates the impact on system availability.
  • None (N) means no impact (0.0 points).
  • Partial (P) indicates performance degradation (0.275 points), like a rate-limited DoS.
  • Complete (C) means the system is down (0.660 points), like a DDoS attack.

CVSS v3.1 Base Metrics

• Attack Vector (AV) specifies how an attacker exploits the vulnerability.
  • Physical (P) requires physical access (0.20 points) via an evil maid attack.
  • Local (L) requires local system access (0.55 points) like malware running on logged-in user.
  • Adjacent Network (A) is possible only within the same network (0.62 points) via Wi-Fi deauthentication.
  • Network (N) allows remote attacks (0.85 points) via web-based RCE.
• Attack Complexity (AC) indicates the conditions required to exploit.
  • High (H) requires specific conditions (0.44 points), such as a non-default setting.
  • Low (L) means the exploit is easy to perform (0.77 points), like automated SQL Injection.
• Privileges Required (PR) indicate necessary privileges.
  • For Unchanged Scope (U):
    • High (H) requires admin/root access (0.27 points) to exploit a Linux kernel bug.
    • Low (L) requires standard user access (0.62 points) for escalation from user to admin.
    • None (N) requires no privileges (0.85 points) and is exploitable by any attacker.
  • For Changed Scope (C):
    • High (H) affects other components (0.50 points) like a hypervisor escape from a VM.
    • Low (L) needs limited privilege, but affects a broader system (0.68 points) like cloud account hijacking.
    • None (N) needs no privileges (0.85 points) like a zero-click exploit.
• User Interaction (UI) specifies if user action is needed.
  • Required (R) needs user action (0.62 points) like a malicious email attachment.
  • None (N) needs no user interaction (0.85 points), like a wormable exploit.
• Confidentiality (C) describes the data exposure.
  • None (N) means no data exposure (0.0 points).
  • Low (L) means some data exposure (0.22 points), like a partial password hash leak.
  • High (H) indicates full data exposure (0.56 points), like a full database dump.
• Integrity (I) specifies the extent of data modification.
  • None (N) means no data modification (0.0 points).
  • Low (L) means some data modification (0.22 points), like limited file editing.
  • High (H) gives full control over the data (0.56 points), like total system compromise.
• Availability (A) indicates the impact on system availability.
  • None (N) means no impact (0.0 points).
  • Low (L) causes some performance degradation (0.22 points), like slowdowns from DoS.
  • High (H) means the system is completely down (0.56 points), like a DDoS attack.

CVSS v3.1 Notes

• CVSS v3.1 has more realistic impact calculations, including Privileges Required (PR) scope changes and User Interaction (UI).
• Higher point values indicate more severe vulnerabilities.
• Each component influences the final CVSS score.

Log4j (Log4Shell) - CVE-2021-44228

• Log4Shell is a Remote Code Execution (RCE) vulnerability in Apache Log4j.
• Attackers can execute arbitrary code by logging a crafted string.
• Attackers can exploit Log4Shell remotely with no authentication, gaining full control of affected systems.
• Attack Vector (AV): Network (N) - Exploitable over the internet (0.85 points).
• Attack Complexity (AC): Low (L) - No special conditions needed (0.77 points).
• Privileges Required (PR): None (N) - No authentication needed (0.85 points).
• User Interaction (UI): None (N) - No user action needed (0.85 points).
• Scope (S): Changed (C) - Affects components beyond the vulnerable system (1.0).
• Confidentiality (C): High (H) - Allows full data access (0.56 points).
• Integrity (I): High (H) - Attacker can modify system files (0.56 points).
• Availability (A): High (H) - Can crash or take over the system (0.56 points).
• Impact = 0.911, Exploitability = 4.94, Base Score = 10.0.
• Log4Shell has a CVSS score of 10.0 (Critical), making it one of the most severe vulnerabilities ever.

Dirty COW - CVE-2016-5195

• Dirty COW is a Linux kernel privilege escalation vulnerability.
• It allows a normal user to overwrite read-only files and gain root access.
• Attack Vector (AV): Local (L) - Needs access to the local system (0.55 points).
• Attack Complexity (AC): Low (L) - No special conditions are needed (0.77 points).
• Privileges Required (PR): Low (L) - Needs basic user access (0.62 points).
• User Interaction (UI): None (N) - Exploit works without user action (0.85 points).
• Scope (S): Unchanged (U) - Only affects the local system.
• Confidentiality (C): High (H) - Attacker gets full system access (0.56 points).
• Integrity (I): High (H) - Attacker can modify all system files (0.56 points).
• Availability (A): High (H) - System can be completely taken over (0.56 points).
• Impact = 0.911, Exploitability = 2.23, Base Score = 7.8.
• Dirty COW has a CVSS score of 7.8 (High Severity) but needs local access.

EternalBlue - CVE-2017-0144

• EternalBlue is a remote exploit in Windows SMB v1.
• It enables unauthenticated attackers to run code remotely.
• EternalBlue was used in WannaCry ransomware and is based on leaked NSA exploits.
• Attack Vector (AV): Network (N) - Can be exploited remotely (0.85 points).
• Attack Complexity (AC): Low (L) - No special conditions needed (0.77 points).
• Privileges Required (PR): None (N) - No authentication needed (0.85 points).
• User Interaction (UI): None (N) - Doesn't need user action (0.85 points).
• Scope (S): Changed (C) - Affects other systems via self-propagation (1.0).
• Confidentiality (C): High (H) - Full system compromise (0.56 points).
• Integrity (I): High (H) - Allows full data modification (0.56 points).
• Availability (A): High (H) - Causes total system failure (0.56 points).
• Impact = 0.911, Exploitability = 4.94, Base Score = 10.0.
• EternalBlue has a CVSS Score of 10.0 (Critical), which led to major global cyberattacks.

Summary of Exploits

• Log4Shell: CVSS Score 10.0, Critical.
• Dirty COW: CVSS Score 7.8, High Severity.
• EternalBlue: CVSS Score 10.0, Critical.