Risk Management Basics: Threats, Vulnerabilities and CVSS

When a specific software flaw is discovered, it gets a name (CVE) and a severity score (CVSS). This is how the whole industry talks about a given vulnerability.

CVE naming

Every disclosed vulnerability gets a CVE ID from MITRE. The format is fixed.

CVE-YYYY-NNNN+

CVE

Common Vulnerabilities and Exposures. The naming database. Operated by MITRE, funded by US CISA.

CVSS

Common Vulnerability Scoring System. A 0.0–10.0 score that reflects severity. Maintained by FIRST.org.

CWE

Common Weakness Enumeration. Categories of weaknesses, not specific instances. CWE-79 = Cross-Site Scripting.

CPE

Common Platform Enumeration. A standard way to name products and versions affected by a CVE.

NVD

National Vulnerability Database. Run by NIST. Takes CVE data and adds CVSS scores, CPE mappings, references.

CVSS severity bands

The 0.0–10.0 base score maps to a named band. These are the CVSS v3.x bands; v4 keeps them the same.

None

0.0

No impact

Low

0.1 – 3.9

Watch

Medium

4.0 – 6.9

Plan to fix

High

7.0 – 8.9

Fix soon

Critical

9.0 – 10.0

Fix now