3 ms·
Even if you have the technologist, it's just too much work and it's soul breaking to go over every CVE, try to understand if the CVE is a real vulnerability or
by user5994461 7y ago
Even if you have the technologist, it's just too much work and it's soul breaking to go over every CVE, try to understand if the CVE is a real vulnerability or not and what it is about. They don't bother most of the time to explain what is the issue or what's the fix.
- lol768 7y ago>They don't bother most of the time to explain what is the issue or what's the fix. This - the vulnerability descriptions are usually incredibly poor. Snyk are bad at this too. What's particularly infuriating is when the descriptions tell you what a generic e.g. XSS or Java deserialisation vulnerability is. It's so incredibly patronising and doesn't tell you anything at all about the _specifics_ of the problem. If you're really lucky you'll be able to find the patch that fixes the CVE on GitHub (often the commit messages are deliberately vague - I guess the devs think it'll be exploited less this way?) and then you can try to reverse engineer what the actual problem was and what you'd need to be to be exploitable.