Page History

The Base Score, as well as Exploitability and Impact subscores, are displayed as a numeric range from 0 to 10, with an associated color based on its importance (

“the higher, the

worst” ).

Kiuwan Insights provides a 2-axis figure that can help you

easily understand these two important characteristics of the vulnerability.

• The closer to the right a vulnerability is, the easier it will be to exploit it.
• The closer to the top

• the vulnerability is, the more important its consequences will be

• .

Image Modified

The Base Score is calculated as a function of Exploitability and Impact Subscores.

Exploitability and Impact subscores are calculated from their associated metrics.

Image Modified

Kiuwan Insights displays the value for every subcore’s metric.

Below you can find the meaning for every metric but, as a rule of thumb, you can consider that the more left is the value of the metric, the more dangerous is the vulnerability.

Let’s understand the meaning of every metric.

Exploitability metrics

• Attack Vector (AV): This metric reflects the level of

• proximity the attacker needs to obtain to the system

• to exploit the vulnerability. The more remote an attacker can exploit the vulnerability, the more vulnerable the system is.
  • Values: Local -  Adjacent -  Network ( L / A / N )
• Access Complexity (AC): Once the target system is reached, this metric reflects the complexity required to exploit the vulnerability (relative to the existence of

• barrier conditions). The easier to exploit the vulnerability, the more vulnerable the system is.
  • Values: Low – Medium – High ( L / M / H )
• Authentication (Au): This metric reflects the number of

• times the

• attack needs to authenticate before being able to exploit the vulnerability. The

• fewer times he needs, the more vulnerable the system is.
  • Values: Multiple – Single – None ( M / S / N )

Impact metrics

• Confidentiality Impact (C): This metric reflects the degree

• to which the vulnerability can read system data and produce confidential information disclosure to non-authorized users.
  • Values: None -  Partial -  Complete ( N / P / C )
• Integrity Impact (I): This metric reflects the degree in which the vulnerability allows the attacker to modify existing system data, compromising the trust and veracity of data.
  • Values: None -  Partial -  Complete ( N / P / C )
• Availability Impact (A): This metric reflects the degree

• to which the vulnerability affects the availability and use of the system.
  • Values: None -  Partial -  Complete ( N / P / C )

Common Vulnerability Scoring System (CVSS) v3

CVSS v2 has evolved to v3 (https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator) introducing changes to metrics (new metrics and different possible values).

However, not all vulnerabilities reported to NIST‘s National Vulnerability Database (NVD) have been scored according to v3 guidelines.

Indeed, only a subset of them has been re-scored.

Image Modified

New vulnerabilities

NIST database is continuously being feed with new vulnerabilities.

Do not worry if, after the date you run the analysis, new vulnerabilities are found that affect some of your components

.

Kiuwan Insights is continuously inspecting the NIST database for new vulnerabilities.

If there are new vulnerabilities that affect some of the components of your app, those components will display those new vulnerabilities (marked as New) without the need to run a new analysis.

Kiuwan will keep your components inventory up-to-date without the need to run new

analyses.

Image Modified