Vulnerability concepts - CVEs, severity, and exploitability

A CVE (Common Vulnerabilities and Exposures) is a unique identifier for a publicly known security vulnerability. CVSS (Common Vulnerability Scoring System) is the score that tells you how bad it is.

The CVE process

1. Vulnerability discovered (researcher, vendor, attacker)
2. Reported to vendor (responsible disclosure) or to a CNA
3. Vendor confirms and develops fix
4. CVE assigned
5. Embargo period (typically 90 days for major vendors)
6. Public disclosure + advisory + patch
7. Distribution packages the fix

After disclosure, attackers have the same information as defenders. Patches within hours-days are critical.

CVSS scoring

CVSS 3.1 produces a score from 0.0 to 10.0:

The score considers:

• Attack vector: network, adjacent, local, physical.
• Attack complexity: low, high.
• Privileges required: none, low, high.
• User interaction: none, required.
• Confidentiality / Integrity / Availability impact: none, low, high.

A critical RCE that requires no privileges and no user interaction scores 9.8+.

Severity vs exploitability

CVSS is severity. Exploitability is whether the vulnerability is actively exploited:

• A critical CVE without a known exploit: still patch urgently.
• A high CVE with a known exploit in the wild: patch immediately.
• A medium CVE in an internet-exposed service: prioritise over the same CVE on an internal host.

The principle: critical + internet-exposed + known exploit = patch in hours.

Read a CVE entry

CVE-2024-12345
Description: Buffer overflow in foo allowing RCE
CVSS 3.1: 9.8 (Critical)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: foo 1.0 - 1.2.3
Fixed in: foo 1.2.4
References: <advisory URL>, <patch URL>

Read the affected version range and the fixed version. Check if the host runs an affected version.

Prioritise

Priority depends on:

1. Severity (CVSS).
2. Internet exposure.
3. Active exploitation.
4. Available mitigation (workaround if patch is delayed).
5. Asset value (data, role).

A critical CVE on a bastion: patch in hours. The same CVE on an isolated lab host: patch in the next cycle.

Knowledge check