Stop 04 · Core Security ConceptsTopics · 10/10

The CVE & CVSS System

In short

Thousands of new vulnerabilities are published every year. CVE gives each one a name, and CVSS gives it a severity score, so teams can talk about them clearly and decide what to patch first.

CVE (Common Vulnerabilities and Exposures) is the standard naming system for known vulnerabilities; CVSS (Common Vulnerability Scoring System) rates their severity — the shared language for discussing and prioritizing vulnerabilities.

The blob leans over an open car bonnet and ties a red warning tag on one engine part.

Think of it like this

A car recall notice

When a car part is faulty, the company issues a recall with a reference number and says how dangerous it is: 'brakes may fail' is urgent, 'radio may crackle' can wait. CVE is the reference number, CVSS is the danger rating.

Watch it happen

Reading one CVSS v3.1 vector (Log4Shell, CVE-2021-44228)

AV:N

AC:L

PR:N

UI:N

S:C

C:H

I:H

A:H

1/5A vector string describes the bug in short codes. This is the famous Log4j bug from 2021, scored 10.0.

The big ideas

What you need to know

CVE is an ID

Format CVE-YEAR-NUMBER. It lets everyone, from vendors to scanners, refer to the same bug.

CVSS bands

0.1 to 3.9 is low, 4.0 to 6.9 medium, 7.0 to 8.9 high, 9.0 to 10.0 critical.

Score is not the whole story

Check if it's being exploited now, using CISA's KEV catalogue or EPSS, and whether you even run that software.

Prioritise patching

Internet-facing plus actively exploited plus critical goes first. A critical bug on an isolated lab box can wait.

See it in code

Walk through the code

bash

1# Check your own projects for known CVEs in dependencies2npm audit                 # Node.js projects3pip install pip-audit && pip-audit    # Python projects4 5# Search a CVE in the official NVD database (in the browser)6# https://nvd.nist.gov/vuln/detail/CVE-2021-44228

1/2npm audit and pip-audit list packages with known CVEs and suggest fixed versions.

Dependency scanners match your package versions against CVE databases and show the CVSS severity of each finding.

Save yourself the pain

Common mistakes

Oops

Patching strictly in CVSS score order.

Do this instead

Factor in exploitation in the wild and exposure. A 7.5 being actively exploited on your web server beats a 9.8 nobody can reach.

Oops

Assuming no CVE means software is safe.

Do this instead

A CVE only exists once someone reports the bug. Keep software updated and minimal anyway.

Your mission

Triage three CVEs

~30 min

Quick check

Which part of a CVSS vector tells you no login is needed to exploit the bug?

Go deeper

1Look up a recent, well-known CVE and read its description and CVSS score.
2Learn the general CVSS severity ranges (low, medium, high, critical) and what they mean for prioritization.
3Understand why a high CVSS score doesn't automatically mean immediate exploitation risk for your specific environment.