The Art and Science of Automated CVSS Predictions

What is CVSS

The Common Vulnerability Scoring System (CVSS) is a standardized method for assessing and quantifying the severity of security vulnerabilities. It provides a numerical score, ranging from 0 to 10. The CVSS score considers various factors, including the ease of exploitation, the impact on confidentiality, integrity, and availability, as well as whether the vulnerability requires user interaction. A higher score indicates a more severe vulnerability.

In the illustration provided below, we showcase the chronological progression and historical timeline of the Common Vulnerability Scoring System open framework.

The Problem

With a significant daily influx of vulnerabilities, the assessment and assignment of CVSS base scores typically demand considerable time, expertise, and human resources. We have observed public CVEs where vulnerabilities appeared without a corresponding CVSS base scores. We have encountered PSIRT teams managing numerous vulnerabilities for the software they develop, and due to the volume of vulnerabilities they face, conducting a CVE assessment is hard and expensive. Ultimately, the PRIOn prioritization vulnerability algorithm considers the vulnerability's severity as one of the many supported features, making it part of the algorithm to receive this information, which cannot be left blank.

PRIOn KB NLP Models CVSS Prediction

Due to all the reasons described in the "The Problem" section, PRIOn has decided to build multiple Natural Language Processing (NLP) models which automates the prediction of the CVSS Base Vectors (not temporal, not environmental) and their corresponding severity scores, for both CVSSv2 and CVSSv3, solely based on textual vulnerability descriptions. Models take a vulnerability description as input and produce a CVSS vector/base score as output using the relevant CVSS (V2/V3) metrics. We created multiple datasets for solving this problem. We utilized a CVSSv3 corpus containing 137,353 CVE documents and a CVSSv2 corpus containing 175,126 CVE documents. We conducted deduplication and performed some cleaning steps on those corpora. In the subsequent images, we conducted analyses on all CVEs, both CVSSv2 and CVSSv3, respectively.

CVSSv3 Metrics and Values

The table below presents a collection of metrics associated with the Base metric group:

Exploratory Data Analysis on CVSSv3 corpus.

CVSSv2 Metrics and Values

The table below presents a collection of metrics associated with the Base metric group:

Exploratory Data Analysis on CVSSv2 corpus.

CVSSv3 Model Performance Evaluation

In the table provided, we illustrate the CVSSv3 model's overall accuracy performance score (94.33) and the performance for each specific CVSSv3 metric, measured in terms of AUC (Area Under the ROC Curve), precision (P), recall (R), and F1 score (F).

CVSSv2 Model Performance Evaluation

In the table provided, we illustrate the CVSSv2 model's overall accuracy performance score (93.90) and the performance for each CVSSv2 metric, measured in terms of AUC (Area Under the ROC Curve), precision (P), recall (R), and F1 score (F).

Case Study: CVE-2023-6359 (Cross Site Scripting)

In the provided image, it's evident that the vulnerability CVE-2023-6359 remains indeterminate. PRIOn Basic analysis can predict the CVSSv2 and CVSSv3 base scores for the CVE description under examination.

Let's examine the predicted result of the above vulnerability CVE-2023-6459 (Cross-Site Scripting). The vulnerability description as follows:

“A Cross-Site Scripting (XSS) vulnerability has been found in Alumne LMS affecting version 4.0.0.1.08. An attacker could exploit the 'localidad' parameter to inject a custom JavaScript payload and partially take over another user's browser session, due to the lack of proper sanitisation of the 'localidad' field on the /users/editmy page.”

In the table below, we demonstrate the optimal metrics selected (in bold) by the trained model for CVSSv3 score calculation.

We can assert that the anticipated CVSSv3 base score of 5.4, along with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, is highly precise.

Case Study: Bug Bounty Report Vulnerability

Let's examine the predicted result of the above vulnerability (SQL Injection). The vulnerability description as follows:

“tenweb-speed-optimizer wordpress plugin by 10web.io, prior to 2.12.22 version was vulnerable to UNAUTHENTICATED SQL injection (in /wp-json/tenwebio/v2/compress-one) which could be chained with insecure deserialization in the plugin to gain RCE. Vendor published the issue as an "authenticated" one (update: wordfence team corrected it !)”

In the table below, we demonstrate the optimal metrics selected (in bold) by the trained model for CVSSv3 score calculation.

We can assert that the anticipated CVSSv3 base score of 9.8, along with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, is highly precise.

Conclusion

A swift and dependable prediction of CVSS base scores for disclosed public or private vulnerabilities is imperative, as highlighted in the 'The Problem' section. Ensuring a prompt and reliable assessment of vulnerabilities is crucial for security professionals to grasp the severity of each vulnerability. At PRIOn, we simplify this process by automatically and transparently generating CVSS vectors and base scores by utilizing the capabilities of our developed Natural Language Processing (NLP) models. PRIOn demonstrates its proficiency in predicting CVSS vectors and base scores for vulnerabilities under scrutiny. As we move forward, we envision PRIOn taking a crucial role in advancing modern vulnerability prioritization practices. This includes furnishing security practitioners with all the essential tools and logic needed for achieving this goal.

How PRIOn can help

PRIOn is an AI driven vulnerability prioritization technology. PRIOn is here to automatically prioritize vulnerabilities, public or private, that matter most across your entire environment. Contact us here for any inquiry/demo. We are here to help you reshape your vulnerability management lifecycle.