2 ms·
I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities. If NVD completely re-scored submitted CV
by Majromax 3y ago
I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities.
If NVD completely re-scored submitted CVEs from scratch, then they'd replace a biased dataset with a noisier but unbiased dataset.
On the other hand, if NVD accepts high severities and only re-scores low severity CVEs, then the collected database might exchange a low-severity bias for a high-severity bias.
- usefulcat 3y ago> I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities. Indeed. It occurs to me that there's a possible feedback loop here. To the exent that NVD increases the severity of all (or even some) CVEs, they are effectively increasing the incentive for vendors to report lower severities, since the vendors may rightly assume that NVD will inflate the severity anyway.