Score by hand, then watch the score mislead you

short · 45 min · Objective 2.3

Task

Read three CVSS vectors by hand, predict the score, check against a calculator, then take two findings with identical base scores and show that their real urgency differs by a wide margin.

Steps

  1. Take three vector strings from your own scan output. For each, write out in plain English what every metric is saying before you compute anything: where the attacker has to be, how hard it is, what privileges they need, whether a user must act, and what is lost.
  2. Predict the base score band -- low, medium, high, critical -- from that reading alone. Then compute it and compare.
  3. Now find two findings in your results with the same or near-identical base score. Write down everything the score does not contain: which host, whether it is reachable from anywhere you care about, whether an exploit exists, whether your configuration enables the vulnerable feature.
  4. Rank the two by real urgency and write the justification in one paragraph.
  5. Repeat with the environmental metrics filled in honestly for your lab -- an asset that matters and one that does not -- and see how far the two scores move apart.

Verify

awk -F, '{print $4}' /tmp/scan-cred.csv | grep -o "CVSS:3[^,]*" | sort | uniq -c | sort -rn | head -5
awk -F, '$5>=9.0 {print $2, $5}' /tmp/scan-cred.csv | sort -u | head -10
awk -F, '$5>=9.0 {print $2}' /tmp/scan-cred.csv | sort -u | wc -l

The first shows the distinct vectors you are working from. The second lists your critical findings with their hosts, and the third counts them. That count is the number a report would carry, and the exercise you just did is the reason it cannot be acted on in the order the tool printed it.

Notes

The vector is more informative than the score and takes ten seconds longer to read. AV:N/AC:L/PR:N/UI:N -- reachable from the network, easy, no privileges, no user interaction -- is the combination that gets mass-exploited, and it is visible at a glance once you can read it.

Two 9.8s are not equally urgent, and after step 3 you have your own example to cite rather than a maxim.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.