de Deutsch en English
binsec GmbH

Common Vulnerability Scoring System (CVSS)

As is common with estimates, risk is assessed differently depending on the perception and experience of the pentester - even if they all refer to the same assessment scheme. However, regulatory bodies such as the Darmstadt Regional Council in particular require a uniform system, as they have to define concrete requirements and measures. As a result, they require pentesters to perform a risk assessment according to the Common Vulnerability Scoring System (CVSS). The CVSS is a metric evaluation scheme that assigns a vulnerability a rating between 0 and 10 based on its conditions of exploitation and its extent of damage. The score represents the outgoing risk of a vulnerability as follows:

Score Risiko
9,0 - 10 Critical
7,0 - 8,9 High
4,0 - 6,9 Medium
0,1 - 3,9 Low

A CVSS score can also be represented as a vector string. This is a short text representation of the values with which the risk of a vulnerability was derived. For example, a vulnerability would be rated with a 10.0 or in vector notation with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H if it can be exploited in a service at any time via the Internet without access data. In addition, the outgoing damage would have to be the complete compromise of various IT systems, so that the three goals of information security (confidentiality, integrity and availability) would be violated. The CVSS vector mentioned above consists of the following features:

  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)

For a detailed description of the criteria and the calculation of the score, we would like to refer to the official documentation of the Common Vulnerability Scoring System: CVSS Calculator

Last modified: Dec. 15, 2022

Pentest Training

Take a look at the pentest training chapters and learn penetration testing:

  1. Preface
  2. Introduction
  3. Legal Framework
  4. Hacking vs. Penetration Testing
  5. Classification
  6. Meaningfulness of Penetration Tests
  7. Penetration Testing Standards
  8. The Hacking Guide
  9. Demonstration of a Penetration Test
  10. Risk Assessment of Identified Vulnerabilities
  11. Structure of Documentation and Reporting
  12. Insider stories: Tales from Dubius Payment Ltd.

Penetation Testing Course

About Pentest Training

Discover the world of penetration testing. Learn how to infiltrate networks and successfully penetrate systems and applications. Acquire the necessary hacking skills and use them when conducting professional penetration tests. Become a real penetration tester. Here you will find the free documents for the Pentest Training of binsec academy GmbH. The binsec academy GmbH offers the corresponding security training lab environments and certifications. However, the knowledge and wiki articles on hacking and penetration testing is universal.

About binsec academy GmbH

binsec academy GmbH is the European provider of online security training with virtual laboratory environments. The core component of all security training is the focus on practice, practice and more practice. In the wiki here you will find the public and freely available course materials. You can put the theory into practice at binsec-academy.com.

Keywords