I'm not saying that the vulnerability isn't severe or important to people running Wordpress, only that CVSS scores are literally a Ouija Board that can come out to whatever the user wants them to.

▲

ferngodfather 5 hours ago | parent | next [-]

Yeah give me a vuln and I can make it anything between a 2 and 8 quite easily. I routinely see 10s that are "Critical 10.0 CVE (but only if you're using X language with X setting changed from default, and the attacker can MiTM your traffic)"

▲

nicce 6 hours ago | parent | prev [-]

> CVSS scores are literally a Ouija Board that can come out to whatever the user wants them to.

Not really. They are very good at describing the technical impact. Sometimes pre-condition is very rare and that reduces overall likelihood but for those few it applies, the impact still could be catastrophic. Who wants to risk it if whole business could go down?

▲

akerl_ 5 hours ago | parent | next [-]

So if I get a 9.8 that doesn't apply to my usage, what is the CVSS score doing for me?

▲

cleansy 5 hours ago | parent | next [-]

Published CVSS is a base score that gives you a hint of how important the analysis of a vulnerability is to prioritise the patching or mitigation. What you see on websites is only ever the base spiciness so to speak. If you have for example wordpress only running in an isolated environment behind internal firewall rules you‘d downgrade it accordingly. It’s a imperfect metric but so far the best we have to signal priorities. It’s all described in its spec that no one seems to read and websites also communicate it badly.

▲

akerl_ 4 hours ago | parent | next [-]

CVSS is impossible to communicate effectively. We don't need a metric; I'm already going to have to read and assess the vulnerability to decide how I actually want to assess the risk given my infrastructure, so the number's not doing me any good.

This isn't just a CVSS issue: there have been a variety of attempts to reduce a risk score down to a single general number and they all end up as somewhere between marketing material, scare tactic, and junk science.

▲

nicce 3 hours ago | parent [-]

> We don't need a metric; I'm already going to have to read and assess the vulnerability to decide how I actually want to assess the risk given my infrastructure, so the number's not doing me any good.

Would you say that vulnerability with CVSS score that points to low is equally important to verify and take care of than CVSS which points to critical?

	▲	akerl_ 3 hours ago \| parent [-]
		Yes. I believe that using CVSS scores as a first pass to decide which vulnerabilities to review is risky. The most boring reason, even if you take CVSS scores at face value, is that in many cases it is possible to leverage multiple "low" severity vulnerabilities into a massive impact. But the bigger reason is that CVSS scores are all over the place, and the people operating roulette wheel that generates them do not have any insight into any specific person's systems.

▲

vntok 5 hours ago | parent | prev [-]

Yes. It's amazing how supposedly security professionals only take the base score "as is" and never adjust.

Many GUI CVSS calculators exist just for this, it takes a minute to requalify a vuln and adjust its CVSS based on your specific environment.

This one for example is pretty basic but works well: https://www.first.org/cvss/calculator/4.0

> These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of complementary/alternative security controls in place, Confidentiality, Integrity, and Availability. The metrics are the modified equivalent of base metrics and are assigned metric values based on the component placement in organization infrastructure.

▲

vntok 5 hours ago | parent | prev [-]

You need to reason about both probability and impact, not one or the other. In your example, it just means that the probability is very low, perhaps even down to 0 in your specific case. But even at a low probability, the impact of the vulnerability remains very high so it helps you reason about it.

For example, you might react differently to these scores:

- <8/10: check that your systems are indeed secure

- 8.6/10: check that your systems are indeed secure and tell your junior analyst to train on creating a custom monitoring rule for that attack and follow-up with you

- 9.8/10: double-check that your systems are indeed secure, ensure that if you had a hole another security layer would have caught it (if not, that's a problem!), set up a honeypot to get some info on the assholes that have repeatedly attacked you lately and will undoubtedly try to 0-day you in the next few hours, etc.

▲

5 hours ago | parent | prev [-]

[deleted]