bugcrowd

Common Vulnerability Scoring System (CVSS) 

CVSS ek system hai jo security ki problems (vulnerabilities) ko 0 se 10 tak ek number deta hai, jisse uski seriousness (kitni dangerous hai) samjhi ja sake. Data security teams is score ka use karti hain taaki wo decide kar sakein kaunsi weakness ko pehle fix karna chahiye.

FIRST (Forum of Incident Response and Security Teams) ek US-based organization hai jiske 500+ members hai worldwide. Ye log CVSS system ko maintain karte hain aur ye ek open platform hai – matlab koi bhi ise use kar sakta hai.

CVSS ka use karna helpful hai kyunki ye ek standard way deta hai security issues ko score karne ka. Lekin, iske kuch limitations bhi hain – jaise ki har situation mein accurate result nahi deta. Isliye ye samajhna zaroori hai ki aapka team CVSS ka sahi use kar raha hai ya nahi.

CVSS 2.0 aur 3.0 ke comparison mein, CVSS 3.0 naya aur updated version hai. Isme kuch naye improvements kiye gaye hain jaise:

• • Score banane mein zyada consistency (ek jaisa hona)

  • “Scoring Tips” ko replace karke better guidance dena users ko

  • Poore system ka review kiya gaya hai taaki aaj ke modern security challenges ko better handle kiya ja sake.

CVSS ka pehla version 2005 mein aaya tha, jo ek research project ka result tha jise NIAC ne handle kiya tha.

Lekin jab pehli baar experts ne (FIRST ke professionals ne) is version ka review kiya, toh unhone kuch serious problems find kiye. Isliye FIRST ne decide kiya ki CVSS ko aur accurate aur practical banaya jaaye.

Is process mein, kai companies aur experts ko mauka diya gaya taaki wo vulnerabilities ko score karein. Saath hi, ek SIG (Special Interest Group) committee banayi gayi.

Aaj ke time mein, CVSS-SIG hi CVSS ke naye versions ko maintain, test aur improve karta hai — regular research aur feedback ke through.

CVSS Base Metric

Ye metric kisi vulnerability ke kuch aise core features ka analysis karta hai jo time ke sath nahi badalte ya jinhe uske environment ka asar nahi padta. Base score do parts me divided hota hai: Exploitability Subscore aur Impact Subscore, jisme har ek alag-alag parameters pe based hota hai.

Exploitability Subscore ye batata hai ki kisi vulnerability ka fayda uthana kitna aasaan hai. Jitna aasaan hota hai exploit karna, utna zyada score hota hai. Ye metric numerical nahi hoti, balki har factor ka apna value set hota hai.

• • Attack Vector (AV): Ye batata hai ki ek attacker ko vulnerability exploit karne ke liye kis level ka access chahiye. Agar physical presence chahiye to score kam hoga, agar local ya network ke through possible ho to score badhta jayega.

  • Attack Complexity (AC): Ye batata hai ki exploit successful karne ke liye attacker ko kitni preparation chahiye. Low complexity ka matlab hai ki koi special condition nahi chahiye, jabki high complexity me attacker ko specific knowledge ya environment ki zarurat padti hai.

  • Privileges Required (PR): Is metric me ye dekha jata hai ki exploit karne ke liye attacker ko kitni access ya permissions chahiye. Low privilege ka matlab basic user level ka access se bhi exploit ho sakta hai, aur high ka matlab administrative ya elevated access chahiye.

  • User Interaction (UI): Ye batata hai ki exploit ke liye kisi dusre user ki madad chahiye ya nahi. Ye metric sirf do values le sakti hai: required ya not required.

CVSS Temporal Metric

Ye score teen factors pe based hota hai aur ye batata hai ki attackers real-world me kaise exploit kar rahe hain, aur aapke paas kya options hain usse fix karne ke liye.

• • Exploit Code Maturity (E): Ye dikhata hai ki exploit code kitna mature ya available hai. Isme values hoti hain:

    • Unproven (koee exploit nahi mila),

    • Proof of Concept (initial code available),

    • Functional (kaam karta hua exploit),

    • High (exploit asani se available aur use ho raha hai).

  • Remediation Level (RL): Ye batata hai ki vulnerability ko fix karna kitna asaan hai. Isme values hoti hain:

    • Official fix (manufacturer ka patch),

    • Temporary fix,

    • Workaround,

    • Unavailable (abhi koi fix nahi hai).

  • Report Confidence (RC): Ye metric define karta hai ki vulnerability kitni confirm hai.

    • Unknown (conflicting reports),

    • Reasonable (reproduce ho sakti hai par root cause unclear),

    • Confirmed (clearly identified aur reproduce ho sakti hai).

CVSS Environmental Metric

Ye score organization-specific hota hai aur Confidentiality, Integrity, aur Availability ke impact ko us specific environment me judge karta hai. Ye bhi base metrics ko modify karta hai based on environment.

• • Security Requirement Score: Ye teen values me define hota hai:

    • Low: Vulnerability ka effect minor hai.

    • Medium: Effect significant hai.

    • High: Effect devastating hai.

Base scores ko same tarike se recalculate kiya jata hai, lekin environment-specific conditions ko consider kiya jata hai.

CVE vs CVSS 

Security aur vulnerabilities ko samajhne ke liye bahut saare abbreviations hote hain – jaise CVE, CVSS, NVD, aur NIST.

CVE ka matlab hota hai Common Vulnerabilities and Exposures. Isse 1999 me MITRE ne launch kiya tha as a public list jisme sabhi known vulnerabilities ka record hota hai – jisme CVE ID, description, date, aur comments included hote hain.

NIST ne 2005 me National Vulnerability Database (NVD) banaya, jo direct data MITRE ke CVE list se leta hai.

Security teams NVD par har CVE ka CVSS score dekh sakti hain – agar available ho. NVD useful isliye hai kyunki yeh aapko alag-alag parameters (product, vendor, OS, type, etc.) ke basis par vulnerabilities search karne ka option deta hai.

Toh summary me:
Jab koi vulnerability detect hoti hai, usse ek CVE ID diya jata hai. Agar possible ho, to uske saath ek CVSS score bhi assign kiya jata hai.

Scoring kaise hoti hai?

Yeh jaanna important hai ki kaunsi cheezein vulnerable hain, aur agar exploit hoti hain to kitna nuksaan ho sakta hai. CVSS scoring system ka base metric isi purpose ke liye bana hai.

Achi baat ye hai ki aap NVD ke calculator ka use karke khud bhi score nikal sakte ho, based on factors jaise exploitability aur impact.

Agar kisi system pe koi badi vulnerability ho, par uska exploit hone se aapke organization ko koi farak nahi padta, to score technically high ho sakta hai – par real-world me risk low ho sakta hai. CVSS 3.0 me API support bhi hoti hai, jisse aap command line ya scripts ke through score calculate kar sakte ho.

CVSS Score Rating

Agar CVSS score high ya critical ho, to aapki VTM ya infosec team alert ho sakti hai. Lekin zaroori ye hai ki aap samjho ki vulnerability actual me aapki organization ke liye kitna risk create karti hai.

Example ke liye:
Agar ek purana web server vulnerable hai, jo sensitive data store nahi karta, VPN ke peeche hai, aur exploit bhi exist karta hai – fir bhi wo aapke liye high priority risk nahi ho sakta. Is case me CVSS ka base score high ho, par actual environment ke hisab se overall risk low ho sakta hai.

Lekin agar aapka ek internet-facing critical system vulnerable hai aur patch nahi laga hua, to turant action lena zaroori hai. Agar wo exploit ho gaya, to organization hack ho sakti hai, aur customer data leak hone ka risk bhi ho sakta hai – jisse aap news me aa sakte ho.