CVSS3.0详解：公开漏洞评估框架与严重性评分指南

需积分: 50 138 浏览量更新于2024-07-18 收藏 582KB PDF 举报

CVSS 3.0,全称Common Vulnerability Scoring System version 3.0，是一个由美国国家安全局计算机应急响应小组(NIAC)开发、由计算机安全响应组织(FIRST)维护的开源框架。其目的是提供一个标准化的方法来评估软件漏洞的特性及其严重性，以便于确定修补的优先级。CVSS 3.0分为三个主要的度量组：基础（Base）、时间（Temporal）和环境（Environmental）。基础度量衡量的是漏洞本身的固有特性，如攻击向量(Attack Vector, AV)、攻击复杂性(Attack Complexity, AC)、权限需求(Privileges Required, PR)、用户影响(User Impact, UI)以及可利用性(Cvss Base Score, 分值范围为0到10)。这些因素综合决定了漏洞的基础风险级别。时间度量关注漏洞随时间变化的特性，如修复可用性(Robustness, R)、漏洞曝光率(Availability Exploit Code, AEC)以及补丁发布日期(Vulnerability Publication Date, VPD)。这有助于了解漏洞在何时可能变得更为严重或更容易被利用。环境度量则考虑了特定用户环境的影响，包括配置变化(Configuration, C)、复杂度变化(Complexity, C)和受影响资产的价值(Asset Value, AV)，这些因素可能会改变漏洞的实际风险。一个完整的CVSS 3.0评分是基于这三个度量的综合结果，形成一个分数，并用向量字符串形式表示，方便理解和交流。FIRST是一家美国非营利组织，负责维护和更新CVSS标准，以支持全球的计算机安全事件响应团队，确保跨领域的信息安全实践一致。 CVSS 3.0的使用对于组织来说至关重要，它提供了量化漏洞风险的工具，帮助安全团队做出有效的风险管理决策，优化资源分配和缓解潜在威胁。通过理解并遵循CVSS 3.0的评分方法，企业能够更有效地应对和管理其IT系统中的脆弱性。

CVSS v3.0 Specification (v1.7) 5 / 21

Introduction

Software, hardware and firmware vulnerabilities pose a critical risk to any organization operating

a computer network, and can be difficult to categorize and mitigate. The Common Vulnerability

Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability,

and produce a numerical score reflecting its severity, as well as a textual representation of that

score. The numerical score can then be translated into a qualitative representation (such as low,

medium, high, and critical) to help organizations properly assess and prioritize their vulnerability

management processes.

In short, CVSS affords three important benefits. First, it provides standardized vulnerability

scores. When an organization uses a common algorithm for scoring vulnerabilities across all IT

platforms, it can leverage a single vulnerability management policy defining the maximum

allowable time to validate and remediate a given vulnerability. Next, it provides an open

framework. Users may be confused when a vulnerability is assigned an arbitrary score by a third

party. With CVSS, the individual characteristics used to derive a score are transparent. Finally,

CVSS enables prioritized risk. When the environmental score is computed, the vulnerability

becomes contextual to each organization, and helps provide a better understanding of the risk

posed by this vulnerability to the organization.

This document describes the official CVSS v3.0 specification.

Metrics

CVSS is composed of three metric groups, Base, Temporal, and Environmental, each consisting

of a set of metrics, as shown in Figure 1.

Figure 1: CVSS v3.0 Metric Groups

The Base metric group represents the intrinsic characteristics of a vulnerability that are constant

over time and across user environments. It is composed of two sets of metrics: the Exploitability

metrics and the Impact metrics.

The Exploitability metrics reflect the ease and technical means by which the vulnerability can be

exploited. That is, they represent characteristics of the thing that is vulnerable, which we refer to

formally as the vulnerable component. On the other hand, the Impact metrics reflect the direct

consequence of a successful exploit, and represent the consequence to the thing that suffers the

impact, which we refer to formally as the impacted component.

剩余20页未读，继续阅读

teabook00

粉丝: 12
资源: 11

CVSS3.0详解：公开漏洞评估框架与严重性评分指南

理解CVSS3.0：评分体系与关键指标解析

Windows XP SP0 MS06-040漏洞详解：远程代码执行与修复

通用弱点评价体系CVSS：评分与应用解析

CVSS3.0评分指导书说明书

cvss3.0评分指导书说明书

请说明如何应用CVSS v3.0标准详细评估一个软件漏洞，并指导如何计算得出其评分向量。

如何使用CVSS v3.0标准评估软件漏洞的严重性，并给出相应的评分向量？

如何利用CVSS v3.0框架对新发现的软件漏洞进行详细评估，并计算其具体的评分向量？

omron cvss

CVSS评分维度

最新资源