Podcast
Questions and Answers
The Environmental Metrics in CVSS modify the final score.
The Environmental Metrics in CVSS modify the final score.
False (B)
What is the highest possible score that can be generated by the CVSS?
What is the highest possible score that can be generated by the CVSS?
- 8.0
- 7.5
- 10.0 (correct)
- 5.0
List the four metric groups in CVSS.
List the four metric groups in CVSS.
Base, Threat, Environmental, Supplemental
A CVSS score between 4.0 and 6.9 is considered _____ severity.
A CVSS score between 4.0 and 6.9 is considered _____ severity.
Which metric group reflects the qualities of a vulnerability that change over time?
Which metric group reflects the qualities of a vulnerability that change over time?
What is required for an attacker to successfully exploit a vulnerability?
What is required for an attacker to successfully exploit a vulnerability?
The attack requirements metric captures the conditions of the vulnerable system that do not affect the success of the attack.
The attack requirements metric captures the conditions of the vulnerable system that do not affect the success of the attack.
Match the CVSS score ranges with their corresponding severity level:
Match the CVSS score ranges with their corresponding severity level:
CVSS provides a quantitative measure of software vulnerabilities.
CVSS provides a quantitative measure of software vulnerabilities.
What does 'Privileges Required (PR)' describe?
What does 'Privileges Required (PR)' describe?
An attack that requires an attacker to inject themselves into the logical network path is referred to as __________.
An attack that requires an attacker to inject themselves into the logical network path is referred to as __________.
What does CVSS stand for?
What does CVSS stand for?
Match the metrics with their descriptions:
Match the metrics with their descriptions:
How may an attack needing multiple attempts to succeed be classified?
How may an attack needing multiple attempts to succeed be classified?
Secrets are pieces of information that can be obtained through reconnaissance.
Secrets are pieces of information that can be obtained through reconnaissance.
What is the role of prerequisites in attack success?
What is the role of prerequisites in attack success?
What does the Attack Vector (AV) metric reflect?
What does the Attack Vector (AV) metric reflect?
The Exploitability metrics reflect the direct consequence of a successful exploit.
The Exploitability metrics reflect the direct consequence of a successful exploit.
What is the score range produced by base metric values?
What is the score range produced by base metric values?
The Exploitability metrics include the _____ metrics and the Impact metrics.
The Exploitability metrics include the _____ metrics and the Impact metrics.
Match the following terms with their descriptions:
Match the following terms with their descriptions:
Which attack vector allows for remote exploitation?
Which attack vector allows for remote exploitation?
Impact metrics reflect how vulnerabilities affect only the vulnerable system itself.
Impact metrics reflect how vulnerabilities affect only the vulnerable system itself.
What is the purpose of amending Threat and Environmental metrics?
What is the purpose of amending Threat and Environmental metrics?
What type of interaction is described as 'Active' in the context of a vulnerable system?
What type of interaction is described as 'Active' in the context of a vulnerable system?
The impact metrics only measure the effects of the vulnerability on the vulnerable system itself.
The impact metrics only measure the effects of the vulnerability on the vulnerable system itself.
What does the confidentiality metric measure in the context of a vulnerability?
What does the confidentiality metric measure in the context of a vulnerability?
In the impact metrics, a 'High' confidentiality score indicates a total loss of __________.
In the impact metrics, a 'High' confidentiality score indicates a total loss of __________.
Match the following confidentiality metric values with their descriptions:
Match the following confidentiality metric values with their descriptions:
What is an example of an Active interaction?
What is an example of an Active interaction?
A confidentiality loss is considered serious if an attacker gains control over only a small amount of restricted information.
A confidentiality loss is considered serious if an attacker gains control over only a small amount of restricted information.
What factors should analysts consider when assessing impact metrics?
What factors should analysts consider when assessing impact metrics?
What does the acronym CVSS stand for?
What does the acronym CVSS stand for?
Supplemental metrics will impact the final calculated CVSS score.
Supplemental metrics will impact the final calculated CVSS score.
What does the Modified Attack Complexity (MAC) metric indicate?
What does the Modified Attack Complexity (MAC) metric indicate?
The abbreviated form for Modified Subsequent System Availability is ______.
The abbreviated form for Modified Subsequent System Availability is ______.
Which metric captures whether an attacker can automate the exploitation of a vulnerability?
Which metric captures whether an attacker can automate the exploitation of a vulnerability?
Match the following supplemental metrics with their descriptions:
Match the following supplemental metrics with their descriptions:
A vector string can include the same metric more than once.
A vector string can include the same metric more than once.
What is the first part of a CVSS v4.0 vector string?
What is the first part of a CVSS v4.0 vector string?
Study Notes
CVSS: Common Vulnerability Scoring System
- A standardized framework for communicating the severity of software vulnerabilities, with numerical scores indicating vulnerability severity.
- The CVSS score ranges from 0 to 10, with higher scores signifying greater severity.
- CVSS is used to prioritize vulnerabilities, helping organizations focus on the most critical ones to mitigate risk.
- CVSS is an open framework, meaning it is freely available and can be adopted by anyone.
CVSS Scoring
-
Base Metrics: Represent core vulnerability characteristics, constant across user environments.
-
Exploitability Metrics: Reflect ease of exploitation. - Attack Vector (AV): Describes the path or context required for exploitation.
- Network (N): Vulnerability can be exploited remotely across a network.
- Adjacent (A): Vulnerability can be exploited within the same network topology, not remotely.
- Local (L): Requires physical access to the vulnerable system.
- Active (A): Vulnerability requires targeted user interaction. - Attack Complexity (AC): Describes the difficulty of exploiting the vulnerability.
- High (H): Requires complex steps and significant technical expertise to exploit.
- Low (L): Can be exploited with minimal effort. - Privileges Required (PR): Indicates the user privileges required to exploit the vulnerability.
- High (H): Attacker needs elevated privileges, like administrator access.
- Low (L): Attacker doesn't need special privileges. - User Interaction (UI): Indicates whether user interaction is needed to exploit the vulnerability.
- None (N): Vulnerability can be exploited without user interaction.
- Required (R): User interaction is required to exploit the vulnerability. - Attack Requirements (AT): Specifies the specific conditions or prerequisites needed for successful exploitation.
- None (N): No specific requirements for exploitation.
- Present (P): Requires specific conditions for exploitation.
-
Impact Metrics: Reflect the consequences of a successful exploit on the vulnerable system and its downstream impact on subsequent systems.
- Confidentiality (C): Measures the impact on confidentiality of information managed by the system.
- High (H): Total loss of confidentiality, with a high impact on the system.
- Low (L): Some loss of confidentiality, with a limited impact on the system.
- Not Defined (X): Confidentiality impact is not defined.
- Integrity (I): Measures the impact on the integrity of system data.
- High (H): Total loss of integrity, with a critical impact on the system.
- Low (L): Some loss of integrity, with limited impact on the system.
- Not Defined (X): Integrity impact is not defined.
- Availability (A): Measures the impact on the system's availability.
- High (H): Total loss of availability, with a major impact on the system.
- Low (L): Some loss of availability, with limited impact on the system.
- Not Defined (X): Availability impact is not defined.
- Confidentiality (C): Measures the impact on confidentiality of information managed by the system.
-
Threat Metrics: Reflect the characteristics of a vulnerability that vary over time.
-
Environmental Metrics: Reflect the characteristics of a vulnerability that are specific to a user's environment.
-
Supplemental Metrics: Provide additional insight into vulnerability characteristics but do not modify the final score.
Vector String: Machine Readable Format
- CVSS V4.0 Vector strings, starting with "CVSS:4.0/", represent a set of CVSS metrics in a concise and machine-readable format.
- They are used to record or transfer CVSS metric information.
###Â Modified Base Metrics
- Allow analysts to override individual Base metric values based on specific user environment characteristics.
- These metrics can be used to provide more accurate and contextually relevant scores.
Supplemental Metrics
- Describe and measure additional attributes of a vulnerability, providing more comprehensive information.
- Include considerations like safety impact, automatability of exploitation, and recovery efforts.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Related Documents
Description
Explore the Common Vulnerability Scoring System (CVSS) in this quiz. Learn about its scoring framework, base metrics, and exploitability metrics designed to communicate and prioritize software vulnerabilities effectively. Understand how CVSS helps organizations mitigate risks related to vulnerabilities.
