Rescore one vulnerability for two of your own hosts

short · 45 min · Objective 3.2

Task

Take one finding present on two lab hosts and apply the environmental metrics, so the same base score produces two different priorities.

Steps

  1. Pick one finding present on two hosts and record its base score and vector in lab/cvss.csv with header host,cve,base,exposure,classification,env_adjustment,priority,reason.
  2. For each host, set exposure and classification from the CMDB, and adjust the environmental metrics accordingly.
  3. Produce two DIFFERENT priorities and state in reason which single factor discriminated.
  4. Add two more inputs CVSS does not contain: whether exploitation is known to be occurring, and whether the host is reachable by the relevant attacker. Record them as extra columns.
  5. Sort your whole scan output by the resulting priority rather than by severity, and record in lab/priority-shift.md how many findings moved more than ten places.

Verify

awk -F, 'NR>1 {print $7}' lab/cvss.csv | sort -u | wc -l
awk -F, 'NR>1 && $8=="" {n++} END {print n+0" with no reason"}' lab/cvss.csv
grep -Ec '[0-9]+' lab/priority-shift.md

Two DISTINCT priorities from one base score, a reason on every row, and a count of findings that moved. If the two priorities came out the same, the two hosts were not different enough -- pick one internet-facing and one isolated.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.