Overview of common Vulnerability Evaluation System (CVSS)

I. Summary

Vulnerabilities is an important factor in network security. It is used in a variety of security products (such as vulnerability scanning, intrusion detection, anti-virus, patch management, and so on) the evaluation of vulnerabilities and their potential impacts. However, there is currently no general and unified evaluation system standard in the industry. The general weakness Evaluation System (CVSS) is an open and free standard developed and maintained by NIAC. Using this standard, we can rate vulnerabilities and help us determine the priority levels for fixing different vulnerabilities.

II. General weakness Evaluation System (CVSS)

2.1 CVSS Elements

We can see the elements of the general weakness Evaluation System (CVSS) and their relationships:

CVSS-model-detailed-8.0.jpg

The following table lists all the elements of the general weakness Evaluation System (CVSS) and their value ranges:

CVSS-metric.jpg

Some elements to be explained are as follows:

1. If the vulnerability can be used remotely or locally, the value should be the value of remote exploitation.
2, the attack complexity score from the original low/high to low/medium/high, see: html "> http://www.first.org/cvss/draft/accepted/060103.html
3. Example of authentication required, such as an Email or FTP account in advance.

Some useful reference resources are as follows:

CVSS score calculator: http://nvd.nist.gov/cvss.cfm? Calculator
Latest CVSS update: http://www.first.org/cvss/draft/
Documents and films: http://www.first.org/cvss/links.html

2.2 CVSS scoring method

2.2.1 basic evaluation
Basic Evaluation refers to the evaluation score of some inherent characteristics of the vulnerability and the potential impact of these features. The value is as follows:

AccessVector = case AccessVector
Locally: 0.7
Remote: 1.0

AccessComplexity = case AccessComplexity
High: 0.6
Medium: 0.8
Lower: 1.0

Authentication = case Authentication
Required: 0.6
Not-required: 1.0

ConfImpact = case ConfidentialityImpact
None: 0
Part: 0.7
Complete: 1.0

ConfImpactBias = case ImpactBias
Normal: 0.333
Confidentiality: 0.5
Integrity: 0.25
Availability: 0.25

IntegImpact = case IntegrityImpact
None: 0
Part: 0.7
Complete: 1.0

IntegImpactBias = case ImpactBias
Normal: 0.333
Confidentiality: 0.25
Integrity: 0.5
Availability: 0.25

AvailImpact = case AvailabilityImpact
None: 0
Part: 0.7
&