20. Vulnerability Scanning and Assessment
20.1 Vulnerability, CVE, CWE and CVSS
A vulnerability is a weakness in software, configuration or process that an attacker could use. A threat is someone or something that could use it, and risk is how likely and how harmful that would be. Thodkyaat: vulnerability = ughdi khidki, threat = chor, risk = chor aat yenyachi shakyata aani nuksan.
| Term | Full form | What it is | Example |
|---|---|---|---|
| CVE | Common Vulnerabilities and Exposures | A unique ID for one publicly known vulnerability | CVE-2011-2523 (the vsftpd 2.3.4 backdoor) |
| CWE | Common Weakness Enumeration | The type of mistake behind vulnerabilities | CWE-89 = SQL Injection |
| CVSS | Common Vulnerability Scoring System | A score from 0.0 to 10.0 for severity | 9.8 = Critical |
| NVD | National Vulnerability Database | US government database with CVE details and scores | nvd.nist.gov |
| Exploit | – | Code or steps that actually use a vulnerability | A Metasploit module |
CVSS severity bands (CVSS v3):
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
A CVSS score is built from things like: can it be attacked over the network? Does the attacker need a login? Does a user need to click something? What happens to confidentiality, integrity and availability (the CIA triad)?
Ravindra Bagale's Tip
Students CVE aani CWE madhe gondhal kartat. Sopa niyam: CVE mhanje ek vishisht bug (ek patient), CWE mhanje bug cha prakar (ek aajar). SQL Injection ha CWE aahe; ekhadya software madhla SQL Injection bug ha CVE aahe. Interview madhe ha prashna nakki yeto.
Practice task
Open nvd.nist.gov and search CVE-2011-2523. Write down its description, CVSS score and severity, and the affected product. Then find which CWE it is mapped to.