Vulnerability classification (CVSS) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding CVSS Base Score Components

Which of the following is NOT a component of the CVSS Base Score?

A Privileges Required

B User Interaction

C Exploit Code Maturity

D Attack Vector

💡 Hint

Think about the core factors that describe the vulnerability itself, not the environment or temporal factors.

The CVSS Base Score includes Attack Vector, User Interaction, Privileges Required, Confidentiality, Integrity, and Availability impacts. Exploit Code Maturity is part of the Temporal Score, not the Base Score.

📋 Factual

intermediate

CVSS Attack Vector Impact

What does an Attack Vector value of Network indicate in CVSS?

A The vulnerability can only be exploited locally on the device.

B The vulnerability can be exploited remotely over a network.

C The vulnerability requires physical access to exploit.

D The vulnerability requires user interaction to exploit.

💡 Hint

Consider how far the attacker needs to be to exploit the vulnerability.

An Attack Vector of Network means the attacker can exploit the vulnerability remotely over a network without physical or local access.

🔍 Analysis

advanced

Calculating CVSS Base Score Impact

Given a vulnerability with the following CVSS Base metrics:
Attack Vector: Network
Privileges Required: None
User Interaction: None
Confidentiality Impact: High
Integrity Impact: Low
Availability Impact: None

Which of the following best describes the overall impact on the system?

A High impact on availability, low on confidentiality, no integrity impact

B Low impact on confidentiality, high on integrity, no availability impact

C No impact on confidentiality, integrity, or availability

D High impact on confidentiality, low on integrity, no availability impact

💡 Hint

Review each impact metric carefully and match them to the description.

The given metrics specify a high confidentiality impact, low integrity impact, and no availability impact, matching option D.

❓ Reasoning

advanced

Temporal Metrics Influence on CVSS Score

How does the Exploit Code Maturity temporal metric affect the CVSS score over time?

A It increases the score as exploit code becomes more available and reliable.

B It decreases the score as exploit code becomes more available and reliable.

C It has no effect on the CVSS score.

D It only affects the environmental score, not the temporal score.

💡 Hint

Think about how the availability of exploit code changes the risk level.

Exploit Code Maturity increases the CVSS score when exploit code is widely available and reliable, indicating higher risk.

❓ Comparison

expert

Comparing CVSS Environmental Metrics

Which environmental metric in CVSS adjusts the score based on how important the affected system's Confidentiality is to an organization?

A Security Requirements - Confidentiality

B Modified Confidentiality Impact

C Confidentiality Impact

D Attack Complexity

💡 Hint

Consider which metric lets an organization express how critical confidentiality is for their environment.

Security Requirements - Confidentiality allows organizations to adjust the score based on how important confidentiality is to them, affecting the environmental score.

Practice

1. What does the CVSS Base Score primarily measure in vulnerability classification?

easy

A. The inherent severity of a vulnerability without considering time or environment

B. The current exploitability of a vulnerability based on available patches

C. The impact of a vulnerability on a specific organization's environment

D. The financial cost of fixing a vulnerability

Solution

1. Step 1: Understand CVSS score components

   CVSS scores have three parts: Base, Temporal, and Environmental. The Base Score measures the fundamental severity of a vulnerability.

2. Step 2: Identify the role of the Base Score

   The Base Score reflects the intrinsic characteristics of a vulnerability that do not change over time or across different environments.

3. Final Answer:

   The inherent severity of a vulnerability without considering time or environment -> Option A

4. Quick Check:

   Base Score = inherent severity [OK]

Hint: Base Score = core severity, ignore time and environment [OK]

Common Mistakes:

• Confusing Base Score with Temporal or Environmental scores
• Thinking Base Score changes over time
• Assuming Base Score includes organizational impact

2. Which of the following is the correct format for a CVSS v3.1 vector string?

easy

A. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

B. CVSS-3.1-AV:N-AC:L-PR:N-UI:N-S:U-C:H-I:H-A:H

C. CVSS3.1:AV=N;AC=L;PR=N;UI=N;S=U;C=H;I=H;A=H

D. CVSSv3.1[AV:N,AC:L,PR:N,UI:N,S:U,C:H,I:H,A:H]

Solution

1. Step 1: Recall CVSS v3.1 vector string syntax

   The official CVSS v3.1 vector string starts with "CVSS:3.1" followed by slash-separated metric abbreviations and values.

2. Step 2: Compare options to official format

   CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H matches the correct format exactly, using slashes and colons as separators.

3. Final Answer:

   CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -> Option A

4. Quick Check:

   Correct CVSS v3.1 vector format = CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [OK]

Hint: Look for 'CVSS:3.1' prefix and slash separators [OK]

Common Mistakes:

• Using dashes or semicolons instead of slashes
• Missing the 'CVSS:3.1' prefix
• Incorrect separator characters

3. Given a vulnerability with the following CVSS v3.1 Base metrics: Attack Vector (AV) = Network, Attack Complexity (AC) = Low, Privileges Required (PR) = None, User Interaction (UI) = None, Scope (S) = Unchanged, Confidentiality (C) = High, Integrity (I) = High, Availability (A) = High, what is the approximate Base Score?

medium

A. 5.0

B. 7.5

C. 9.8

D. 3.2

Solution

1. Step 1: Identify metric values and their impact

   AV: Network (high impact), AC: Low (easy to exploit), PR: None (no privileges needed), UI: None (no user interaction), S: Unchanged, C/I/A: High impact on confidentiality, integrity, availability.

2. Step 2: Use CVSS v3.1 calculator logic

   These metrics correspond to a critical vulnerability with a Base Score near 9.8, indicating very high severity.

3. Final Answer:

   9.8 -> Option C

4. Quick Check:

   Critical metrics with no privileges and high impact = 9.8 [OK]

Hint: High impact + no privileges + network vector = ~9.8 score [OK]

Common Mistakes:

• Underestimating score by ignoring high impact metrics
• Confusing Scope Unchanged with Changed
• Mixing up privileges required levels

4. A security analyst notices a CVSS vector string: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. What is the main error in interpreting this vector?

medium

A. Thinking privileges are required when they are not

B. Believing the attack vector is Network instead of Local

C. Ignoring that the scope is Changed, affecting impact

D. Assuming the vulnerability requires no user interaction

Solution

1. Step 1: Analyze the UI (User Interaction) metric

   The vector shows UI:R, meaning user interaction is Required, not None.

2. Step 2: Identify common misinterpretation

   Assuming UI:N (no user interaction) would be incorrect here; the vulnerability needs user action to exploit.

3. Final Answer:

   Assuming the vulnerability requires no user interaction -> Option D

4. Quick Check:

   UI:R means user interaction required, not none [OK]

Hint: Check UI metric carefully: R means user interaction required [OK]

Common Mistakes:

• Ignoring UI:R and assuming no user action needed
• Mixing up AV:L (Local) with Network
• Overlooking Scope Changed impact

5. An organization wants to prioritize fixing vulnerabilities that have a high CVSS Environmental Score but a medium Base Score. Which approach best explains this prioritization?

hard

A. Fix only vulnerabilities with the highest Base Score regardless of environment

B. Focus on vulnerabilities that impact the organization's specific environment more severely, even if their general severity is medium

C. Ignore Environmental Scores and focus on Temporal Scores for patch urgency

D. Prioritize vulnerabilities with low Base Scores to reduce workload

Solution

1. Step 1: Understand Environmental Score purpose

   The Environmental Score adjusts the Base Score to reflect how a vulnerability affects a specific organization's environment, considering factors like system importance and security controls.

2. Step 2: Apply prioritization logic

   Prioritizing vulnerabilities with high Environmental Scores means focusing on those that pose greater risk in the organization's context, even if their Base Score is only medium.

3. Final Answer:

   Focus on vulnerabilities that impact the organization's specific environment more severely, even if their general severity is medium -> Option B

4. Quick Check:

   Environmental Score = org-specific risk priority [OK]

Hint: Environmental Score shows real risk to your organization [OK]

Common Mistakes:

• Ignoring Environmental Scores in prioritization
• Confusing Temporal Score with Environmental Score
• Assuming Base Score alone dictates fix order