5 ms·
This is a dumb way of scoring the bug. The bug itself doesn't enable any of those. An app using the library might have that vuln.
by philipwhiuk 1y ago
This is a dumb way of scoring the bug.
The bug itself doesn't enable any of those. An app using the library might have that vuln.
- Ekaros 1y agoScore which is based how someone could theoretically use the tool. It might be right, but it also feels so wrong. I would in reality probably rank this issue lower. And in some more properly engineered systems it would have lot less criticality.
- philipwhiuk 1y agoBut: > someone could theoretically use the tool makes every single logic error a 9.9
- MattPalmer1086 1y agoIt's a generic problem with using CVSS to score library vulnerabilities. CVSS is designed around complete systems, so it's totally crap to apply it to libraries. I see a lot of critical (9+) supposed JavaScript "remote code execution with no authentication" CVEs being posted... Right, if you are running it in an NPM server exposed to malicious user input with no authentication. Actually it runs client side in the browser and at best it's a prototype pollution vuln with a much lower score.
- justin66 1y ago> This is a dumb way of scoring the bug. The above is a motto for the entire vulnerability industrial complex.