4 ms·
Do you think the scores in this case is too high or too low?
by icegreentea2 5y ago
Do you think the scores in this case is too high or too low?
- junon 5y agoToo high. But it's not exactly about the score. The components of each rating don't make sense for how software is written these days. For example, since libraries aren't always used in networking contexts, but usually can be, CVE scores against them almost always include "network vector" as a means of exploitation, which immediately puts the score into the high 5 or 6 (medium high, if memory serves) - even if the library has nothing to do with networking. It makes little sense these days as opposed to back in the earlier days of the internet where many network-relayed applications were self contained and didn't use a lot of disparate libraries like we do today. Stuff like that - it's antiquated. It needs to be redone in my opinion.