5.3 CVSS Scoring & Threat Intelligence

5.3 CVSS Scoring & Threat Intelligence

Quick Answer: The Common Vulnerability Scoring System (CVSS) is an open industry framework maintained by FIRST (Forum of Incident Response and Security Teams) that measures the technical severity of software vulnerabilities on a standardized scale from 0.0 to 10.0. CVSS scores are communicated using vector strings (e.g., CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Vulnerabilities are uniquely indexed worldwide using CVE (Common Vulnerabilities and Exposures) identifiers, which are enriched by NIST's National Vulnerability Database (NVD) with CVSS scores, CWE (Common Weakness Enumeration) flaw types, and CPE (Common Platform Enumeration) hardware/software specifications.

In global cybersecurity operations, security teams must communicate clearly about software flaws across vendor boundaries, security tools, and international borders. If one vendor describes a vulnerability as "critical" while another calls the same flaw "moderate," security analysts cannot effectively prioritize remediation efforts.

To establish a common language, the cybersecurity community relies on standardized scoring frameworks and open vulnerability databases. For the Cisco Certified Support Technician (CCST) Cybersecurity exam, candidates must understand how CVSS scores are constructed, how to interpret CVSS vector strings, and how to navigate core vulnerability repositories like CVE, NVD, CWE, and CISA's KEV catalog.

---

The Common Vulnerability Scoring System (CVSS) Framework

CVSS provides a standardized technique to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. Scores range from 0.0 (least severe) to 10.0 (most severe).

CVSS Qualitative Severity Rating Scale

---

Deep Dive: CVSS v3.1 Metric Structure

CVSS v3.1 divides metrics into three distinct metric groups: Base, Temporal, and Environmental.

+-----------------------------------------------------------------------+
|                      CVSS v3.1 METRIC GROUPS                          |
+-----------------------------------------------------------------------+
| 1. BASE METRICS (Intrinsic & Constant Across Environments)            |
|    - Exploitability: Attack Vector (AV), Complexity (AC), Privileges (PR), User Interaction (UI)|
|    - Scope: Unchanged (U) vs. Changed (C)                             |
|    - Impact: Confidentiality (C), Integrity (I), Availability (A)    |
+-----------------------------------------------------------------------+
| 2. TEMPORAL METRICS (Changes Over Time)                               |
|    - Exploit Code Maturity (E), Remediation Level (RL), Report Confidence (RC)|
+-----------------------------------------------------------------------+
| 3. ENVIRONMENTAL METRICS (Customized to Specific Enterprise Context)  |
|    - Modified Base Metrics & Security Requirements (CR, IR, AR)      |
+-----------------------------------------------------------------------+

1. Base Metric Group

Base metrics represent the intrinsic characteristics of a vulnerability that remain constant over time and across different user environments. It is composed of Exploitability Metrics, Scope, and Impact Metrics.

A. Exploitability Metrics

• Attack Vector (AV): Reflects the context by which vulnerability exploitation is possible:
  • Network (N): Bound to network stack; exploitable remotely across the Internet.
  • Adjacent (A): Exploitable only from the same physical or logical network (e.g., Bluetooth, local Wi-Fi, same VLAN).
  • Local (L): Requires local shell access or user opening a malicious file locally.
  • Physical (P): Requires physical interaction with target hardware (e.g., USB rubber ducky).
• Attack Complexity (AC): Measures conditions beyond the attacker's control required to execute the attack:
  • Low (L): No specialized conditions; repeatable execution.
  • High (H): Exploitation depends on race conditions, specific memory layouts, or MitM positioning.
• Privileges Required (PR): Level of administrative privileges required before exploiting:
  • None (N): Unauthenticated attacker can exploit.
  • Low (L): Requires standard unprivileged user account.
  • High (H): Requires administrative or root privileges.
• User Interaction (UI): Captures whether a human user must participate:
  • None (N): Can be exploited automatically without user interaction.
  • Required (R): Requires a user to click a link, open a phishing PDF, or accept a prompt.

B. Scope (S)

• Unchanged (U): The exploited vulnerability impacts only the software component managing the authority.
• Changed (C): Extremely important! A vulnerability in one software component impacts resources managed by a different security authority (e.g., a hypervisor escape bug where a guest virtual machine breaks out to compromise the host operating system, or Cross-Site Scripting where browser sandbox is breached).

C. Impact Metrics

• Confidentiality Impact (C): High (H), Low (L), None (N).
• Integrity Impact (I): High (H), Low (L), None (N).
• Availability Impact (A): High (H), Low (L), None (N).

Decoding CVSS Vector Strings

CVSS metrics are represented as a compact text string separated by slashes. Security analysts must be capable of reading vector strings:

$\text{Vector String: } \texttt{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H}$

• CVSS:3.1 = Standard version 3.1.
• AV:N = Network Attack Vector (remotely exploitable).
• AC:L = Low Attack Complexity (easy to execute).
• PR:N = Privileges Required None (unauthenticated).
• UI:N = User Interaction None (no user click needed).
• S:U = Scope Unchanged.
• C:H/I:H/A:H = High Impact to Confidentiality, Integrity, and Availability.
• Calculated Score: 9.8 CRITICAL (This string represents a catastrophic unauthenticated remote code execution vulnerability).

CVSS v4.0 Enhancements: Next-Generation Metrics

Released by FIRST in late 2023, CVSS v4.0 addresses common criticisms of v3.1 by providing finer granular metrics and reducing reliance on raw Base scores alone.

+-----------------------------------------------------------------------+
|                       CVSS v4.0 NOMENCLATURE UPDATES                  |
+-----------------------------------------------------------------------+
| CVSS-B   --> Base Metrics Only                                        |
| CVSS-BT  --> Base + Threat Metrics                                    |
| CVSS-BE  --> Base + Environmental Metrics                             |
| CVSS-BTE --> Base + Threat + Environmental Metrics                    |
+-----------------------------------------------------------------------+

Key Improvements in CVSS v4.0

1. Explicit Nomenclature: Clearly designates which metric groups are included in a reported score (e.g., CVSS-BTE explicitly signals that threat and environmental context were factored in).
2. Threat Metric Group: Replaces the legacy "Temporal" group. Focuses heavily on Exploit Maturity (E) with simplified values: Not Defined (NOT_DEFINED), Attacked (A), Proof-of-Concept (P), and Unreported (U).
3. Supplemental Metrics: Provides optional contextual attributes that do not alter the numerical score, but inform operational teams:
   • Safety (S): Indicates whether exploiting the flaw could cause physical injury or loss of human life (critical for Operational Technology/ICS environments).
   • Automatable (A): Indicates if an attacker can automate exploitation across a wormable network.
   • Recovery (R): Indicates performance recovery effort (Automatic, User, Irrecoverable).
   • Value Density (V): Concentration of assets (Diffused vs Concentrated).

---

Global Vulnerability Repositories & Identification Standards

Cybersecurity analysts navigate several public vulnerability databases and standard dictionaries:

1. CVE (Common Vulnerabilities and Exposures)

• Overview: An international dictionary of publicly known cybersecurity vulnerabilities maintained by MITRE Corporation alongside authorized CVE Numbering Authorities (CNAs) (e.g., Cisco, Microsoft, Red Hat, Google).
• Syntax: CVE-YYYY-NNNNN (e.g., CVE-2024-21887).
• Purpose: Provides a unique, standardized name for every single vulnerability instance worldwide, eliminating naming confusion across vendors.

2. NVD (National Vulnerability Database)

• Overview: Operated by the U.S. National Institute of Standards and Technology (NIST).
• Function: Synchronizes with CVE records and enriches them with technical details: calculates official CVSS v3.1/v4.0 scores, assigns CPE identifiers, and links to CWE weakness categories.

3. CWE (Common Weakness Enumeration)

• Overview: A community-developed dictionary of software and hardware weakness types (flaw categories).
• Difference between CVE and CWE:
  • CVE identifies a specific instance of a bug in a specific software product (e.g., CVE-2017-5638 in Apache Struts).
  • CWE categorizes the underlying flaw type across computer science (e.g., CWE-89: Improper Neutralization of Special Elements used in an SQL Command [SQL Injection] or CWE-79: Cross-Site Scripting).

4. CAPEC (Common Attack Pattern Enumeration and Classification)

• Overview: Maintained by MITRE; catalog of common mechanisms and attack patterns used by adversaries to exploit weaknesses (e.g., CAPEC-66: SQL Injection attack pattern).

5. CISA KEV (Known Exploited Vulnerabilities Catalog)

• Overview: Managed by the Cybersecurity and Infrastructure Security Agency (CISA).
• Purpose: An authoritative listing of CVEs that have been actively exploited in real-world cyberattacks. Binding Operational Directives (BOD 22-01) mandate that U.S. federal civilian agencies patch CISA KEV vulnerabilities within strict deadlines.