4 ms·

https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L... I get 6.

https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L... I get 6.5 .. that seems kind of serious.

tptacek 10y ago
CVSS is a ouija board. You can make it say whatever you want. I strongly recommend people avoid CVSS. Pentesters with clients that require CVSS in reports spend an extra couple minutes on every vuln in that silly calculator trying to figure out how to make XSS come out to sev:med and logout CSRF to sev:info.
- blazespin 10y ago
  CVSS is an ouija board .. You can't make it say whatever you want. Each item has pretty well documented constraints. It's not great, but do you have something better?
  - dsacco 10y ago
    Severity rating is a highly contextual process, for which CVSS fails magnificently. Not only is it devoid of context (is this CSRF on private messaging or password reset?), it is not consistent. If you browse the vulnerabilities listed by CVSS for random Linux utilities, for example, you'll find the same vulnerability listed several times with different ratings despite them apparently having the same exploitation requirements and final impact ("authentication not required, remote attacker, potential user data compromise", etc). Then it will generally go on to give a vague explanation that is absent any real exploitation details and simply link to five different websites that all copy-pasted the same SecLists disclosure verbatim. Basically, it's crap, and it exists because the information security industry is bifurcated into two different industries - the risk folks and scanner Rockies who don't have any real technical competency but who love to have things like the CISSP and those who actually know what they're doing in the trenches of technical penetration testing and security audits. The industry unfortunately attracts two distinct crowds - people who can and do develop actual software, but who specialize in security, and people who can talk the talk and have a vested interest in the pomp that comes along with crappy guidelines. If you asked a real vulnerability researcher like Tavis Ormandy to CVSS score any of his findings, he'd probably laugh. His disclosures are usually verbose precisely because this is an industry that should be nuanced. Just because we have nothing better does not mean we should heed an abysmal system.
  - deleted 10y ago
    [deleted]

https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L... I get 6.5 .. that seems kind of serious.

tptacek 10y ago

CVSS is a ouija board. You can make it say whatever you want. I strongly recommend people avoid CVSS. Pentesters with clients that require CVSS in reports spend an extra couple minutes on every vuln in that silly calculator trying to figure out how to make XSS come out to sev:med and logout CSRF to sev:info.

blazespin 10y ago
CVSS is an ouija board .. You can't make it say whatever you want. Each item has pretty well documented constraints. It's not great, but do you have something better?
- dsacco 10y ago
  Severity rating is a highly contextual process, for which CVSS fails magnificently. Not only is it devoid of context (is this CSRF on private messaging or password reset?), it is not consistent. If you browse the vulnerabilities listed by CVSS for random Linux utilities, for example, you'll find the same vulnerability listed several times with different ratings despite them apparently having the same exploitation requirements and final impact ("authentication not required, remote attacker, potential user data compromise", etc). Then it will generally go on to give a vague explanation that is absent any real exploitation details and simply link to five different websites that all copy-pasted the same SecLists disclosure verbatim. Basically, it's crap, and it exists because the information security industry is bifurcated into two different industries - the risk folks and scanner Rockies who don't have any real technical competency but who love to have things like the CISSP and those who actually know what they're doing in the trenches of technical penetration testing and security audits. The industry unfortunately attracts two distinct crowds - people who can and do develop actual software, but who specialize in security, and people who can talk the talk and have a vested interest in the pomp that comes along with crappy guidelines. If you asked a real vulnerability researcher like Tavis Ormandy to CVSS score any of his findings, he'd probably laugh. His disclosures are usually verbose precisely because this is an industry that should be nuanced. Just because we have nothing better does not mean we should heed an abysmal system.
- deleted 10y ago
  [deleted]