7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation

7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation

In professional vulnerability management and CREST-certified penetration testing, technical findings must be communicated through standardized, globally recognized taxonomies. Without standardized frameworks, disparate security tools and stakeholders cannot consistently describe flaws, establish technical severity, or prioritize remediation engineering. This section examines the foundational classification architectures—CVE, CWE, and NVD—and provides an in-depth breakdown of the Common Vulnerability Scoring System (CVSS v3.1) alongside real-world risk prioritization strategies.

---

Vulnerability Classification Frameworks: CVE, CWE, and NVD

+-----------------------------------------------------------------------------+
|                   VULNERABILITY TAXONOMY RELATIONSHIP                       |
+-----------------------------------------------------------------------------+
|  CWE (Common Weakness Enumeration) - MITRE                                  |
|  * The generic weakness category / root architectural flaw                  |
|  * Example: CWE-89 (SQL Injection) or CWE-79 (Cross-Site Scripting)         |
+-----------------------------------------------------------------------------+
                                     |
                                     v (Specific instance in software)
+-----------------------------------------------------------------------------+
|  CVE (Common Vulnerabilities and Exposures) - MITRE                         |
|  * Standardized dictionary entry for a specific flaw in a specific product  |
|  * Format: CVE-YYYY-NNNNN (e.g., CVE-2021-44228)                            |
+-----------------------------------------------------------------------------+
                                     |
                                     v (Enrichment and scoring)
+-----------------------------------------------------------------------------+
|  NVD (National Vulnerability Database) - NIST                               |
|  * Assigns CVSS v2.0 / v3.1 Base Scores and Vector Strings                  |
|  * Maps affected products via CPE (Common Platform Enumeration)             |
|  * Aggregates patch advisories, exploits, and technical references         |
+-----------------------------------------------------------------------------+

1. MITRE CVE (Common Vulnerabilities and Exposures)

• Origin & Purpose: Maintained by the MITRE Corporation and funded by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), CVE is a free, publicly accessible dictionary of standardized identifiers for known cybersecurity vulnerabilities.
• Identification Syntax: CVE-[Year]-[Sequential Digits]
  • Prior to 2014, the sequence number was restricted to four fixed digits (e.g., CVE-2013-1234).
  • In 2014, MITRE expanded the syntax to support arbitrary digit lengths (e.g., CVE-2024-123456) to handle surging vulnerability reporting volumes.
• CVE Numbering Authorities (CNAs): Authorized entities (including major software vendors such as Microsoft, Apple, Red Hat, and independent research organizations) designated to allocate CVE numbers directly to newly discovered flaws within their products or research scopes.

2. MITRE CWE (Common Weakness Enumeration)

• Origin & Purpose: A community-driven dictionary and hierarchical taxonomy of software and hardware weakness types. While a CVE represents an individual, discrete vulnerability in a specific product version, a CWE describes the underlying architectural, design, or implementation defect.
• Core Examples:
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection).
  • CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting).
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection).
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer (Buffer Overflow).
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal).

3. NIST NVD (National Vulnerability Database)

• Origin & Purpose: Operated by the U.S. National Institute of Standards and Technology (NIST), the NVD is the U.S. government repository of standards-based vulnerability management data.
• Enrichment Functions: The NVD synchronizes with MITRE's CVE list and enriches each record with:
  • CVSS Metrics: Evaluates and calculates official CVSS v2.0 and CVSS v3.1 vector strings and base severity scores.
  • CPE (Common Platform Enumeration): Structured naming syntax identifying affected software applications, operating system platforms, and hardware models (e.g., cpe:2.3:a:apache:http_server:2.4.49:*:*:*:*:*:*:*).
  • Fix References & Advisories: Aggregates vendor patch bulletins, security advisories, and public exploit disclosures.

---

CVSS v3.1 Metric Architecture in Depth

The Common Vulnerability Scoring System (CVSS) is an open industry standard maintained by FIRST (Forum of Incident Response and Security Teams). CVSS version 3.1 captures vulnerability characteristics through three coordinated metric groups: Base, Temporal, and Environmental.

                                CVSS v3.1 METRIC GROUPS
+-----------------------------------------------------------------------------------+
| BASE METRICS (Intrinsic, Constant across time and environments)                   |
|   * Exploitability: Attack Vector (AV), Attack Complexity (AC),                   |
|                     Privileges Required (PR), User Interaction (UI)               |
|   * Scope:          Scope (S: Unchanged [U] vs Changed [C])                       |
|   * Impact:         Confidentiality (C), Integrity (I), Availability (A)          |
+-----------------------------------------------------------------------------------+
                                          |
                                          v
+-----------------------------------------------------------------------------------+
| TEMPORAL METRICS (Fluctuate over time)                                             |
|   * Exploit Code Maturity (E), Remediation Level (RL), Report Confidence (RC)     |
+-----------------------------------------------------------------------------------+
                                          |
                                          v
+-----------------------------------------------------------------------------------+
| ENVIRONMENTAL METRICS (Contextualized to specific enterprise deployment)          |
|   * Modified Base Metrics (MAC, MPR, MUI, MS, MC, MI, MA)                         |
|   * Confidentiality, Integrity, Availability Requirements (CR, IR, AR)            |
+-----------------------------------------------------------------------------------+

1. Base Metric Group: Exploitability Metrics

Base Exploitability metrics measure the ease and technical prerequisites required to exploit a vulnerability:

• Attack Vector (AV): Measures the contextual access boundary required to execute the exploit.

  • Network (AV:N): Remotely exploitable across routed networks or the public internet without network positioning (e.g., unauthenticated HTTP request).
  • Adjacent (AV:A): Requires shared physical or logical network proximity (e.g., local Layer 2 broadcast domain, Bluetooth range, local Wi-Fi subnet).
  • Local (AV:L): Exploitation requires local interactive console access, SSH shell access, or local execution of malicious code (e.g., local privilege escalation flaws).
  • Physical (AV:P): Requires direct physical manipulation of target hardware (e.g., physical USB insertion, cold boot attack, FireWire DMA).

• Attack Complexity (AC): Measures conditions beyond the attacker's immediate control that are necessary to exploit the flaw.

  • Low (AC:L): No specialized conditions; the exploit is repeatable at will without race conditions or complex environmental prerequisites.
  • High (AC:H): Successful exploitation relies on conditions outside the attacker's control, such as winning a race condition, bypassing ASLR without an information leak, or executing a man-in-the-middle positioning attack.

• Privileges Required (PR): Describes the level of administrative access the attacker must hold before attempting exploitation.

  • None (PR:N): Completely unauthorized; no authentication credentials required.
  • Low (PR:L): Requires basic authenticated user privileges (e.g., standard domain user or non-privileged web application account).
  • High (PR:H): Requires administrative, root, or service-tier privileges.

• User Interaction (UI): Captures whether a separate human user must participate in the exploitation sequence.

  • None (UI:N): Exploitation occurs autonomously without human intervention.
  • Required (UI:R): A human user must perform an action (e.g., clicking a malicious link, opening a weaponized email attachment, approving an authentication dialog).

2. Base Metric Group: Scope (S)

Scope captures whether an exploited vulnerability can affect security resources beyond its native execution environment:

• Unchanged (S:U): The compromised component and the impacted resources belong to the same security authority. The vulnerability cannot breach its execution boundary.
• Changed (S:C): The vulnerable component impacts resources governed by a different security authority or execution sandbox.

3. Base Metric Group: Impact Metrics

Impact metrics evaluate the worst-case consequence on the primary security triad within the impacted scope:

• Confidentiality (C): None (N), Low (L), High (H - total information disclosure of all system data).
• Integrity (I): None (N), Low (L), High (H - complete modification of system files, configurations, or database records).
• Availability (A): None (N), Low (L), High (H - total denial of service, resource exhaustion, or unrecoverable crash).

4. CVSS Qualitative Severity Rating Scale

CVSS Base scores range on a calibrated logarithmic scale from 0.0 to 10.0:

Vector String Anatomy

A complete CVSS v3.1 vector string is formatted as follows:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This vector represents a maximum-severity flaw (Base Score 9.8 Critical): Network accessible (AV:N), Low complexity (AC:L), No privileges (PR:N), No user interaction (UI:N), Scope unchanged (S:U), and High impact across Confidentiality, Integrity, and Availability.

---

Temporal & Environmental Metric Groups

While the Base score represents a static, universal baseline, real-world risk fluctuates over time and varies by organizational deployment.

                               TEMPORAL METRICS
+-----------------------+-----------------------+-----------------------+
| Exploit Code Maturity |   Remediation Level   |   Report Confidence   |
|          (E)          |         (RL)          |         (RC)          |
+-----------------------+-----------------------+-----------------------+
| * Unproven (U)        | * Official Fix (O)    | * Unknown (U)         |
| * Proof-of-Concept (P)| * Temporary Fix (T)   | * Reasonable (R)      |
| * Functional (F)      | * Workaround (W)      | * Confirmed (C)       |
| * High (H)            | * Unavailable (U)     | * Not Defined (X)     |
+-----------------------+-----------------------+-----------------------+

• Temporal Metrics:

  • Exploit Code Maturity (E): Measures the current availability of reliable exploit code. If no exploit exists (E:U), the effective score drops. If weaponized exploits are integrated into public automated frameworks like Metasploit (E:H), the score rises.
  • Remediation Level (RL): Adjusts the score based on remediation availability. An official vendor patch (RL:O) reduces score impact, whereas an unavailable fix (RL:U) maintains maximum urgency.
  • Report Confidence (RC): Measures the degree of confirmation regarding the vulnerability's technical validity.

• Environmental Metrics:

  • Modified Base Metrics (e.g., MAC, MPR, MAV): Allows security architects to re-score a vulnerability based on compensating controls. For example, if a vulnerable database port is shielded behind an air-gapped firewall that restricts access strictly to the local subnet, the Modified Attack Vector can be adjusted from Network (AV:N) to Adjacent (MAV:A) or Local (MAV:L).
  • Security Requirements (CR, IR, AR): Scales the impact based on the specific asset's operational role. On a public brochureware web server, Availability Requirement (AR) may be High while Confidentiality Requirement (CR) is Low.

---

Vulnerability Triage & Risk-Based Remediation Prioritisation

A critical technical failure in modern enterprise defense is "CVSS-Only Prioritization." Security teams that blindly filter remediation backlogs strictly by CVSS Base Score >= 9.0 fail to mitigate genuine real-world risk.

+-----------------------------------------------------------------------------+
|                   MODERN RISK-BASED TRIAGE METHODOLOGY                      |
+-----------------------------------------------------------------------------+
|                          CVSS Base Severity (0.0 - 10.0)                    |
|                                         +                                   |
|                         Asset Criticality & Business Value                  |
|                                         +                                   |
|                       Network Exposure (External vs Internal)               |
|                                         +                                   |
|                 Threat Intelligence (CISA KEV / EPSS Probability)           |
|                                         +                                   |
|                          Compensating Security Controls                     |
|                                         =                                   |
|                         ACTIONABLE REMEDIATION PRIORITY                     |
+-----------------------------------------------------------------------------+

The Four Pillars of Contextual Risk Prioritisation

1. Asset Criticality & Business Value: A CVSS 9.8 flaw residing on an isolated test workstation in a disconnected research sandbox presents far lower actual business risk than a CVSS 7.2 vulnerability located on an internet-facing payment gateway processing credit card transactions.
2. Threat Intelligence & Weaponization (CISA KEV): CISA maintains the Known Exploited Vulnerabilities (KEV) catalog. A vulnerability listed on the KEV catalog indicates active, weaponized exploitation in the wild by advanced persistent threat (APT) groups or ransomware operators. KEV presence immediately elevates any vulnerability—even a Medium CVSS score—to the highest remediation tier.
3. Exploit Prediction Scoring System (EPSS): Maintained by FIRST, EPSS models the statistical probability (0.0% to 100.0%) that a software vulnerability will be exploited in the wild within the next 30 days, enabling predictive, proactive patching before weaponization occurs.
4. Compensating Architectural Controls: Network micro-segmentation, Web Application Firewalls (WAF) running active virtual patches, intrusion prevention signatures, and multi-factor authentication (MFA) dramatically mitigate the immediate exploitability of unpatched systems, allowing security teams to allocate engineering resources strategically.