Skip to content

Intermediate · Enumeration and vulnerability assessment · topic 16 of 35 · 18 min

CVE and CVSS: naming and scoring weaknesses

Explanation

A CVE is a public, unique ID for a specific known vulnerability, like CVE-2021-44228. CVSS is a score from 0 to 10 that rates how severe a vulnerability is. Together they let the whole industry talk about the same flaw and agree how urgent it is.

Why the world needs common names

There are thousands of known vulnerabilities. If everyone described them in their own words, no one could keep track. So the industry uses CVE identifiers: a CVE (Common Vulnerabilities and Exposures) ID is a unique public name for one specific flaw in one specific product. For example, CVE-2021-44228 is the famous "Log4Shell" flaw. The number tells you the year and a serial.

When a tester finds an outdated version during enumeration, they look up whether it has a CVE. If it does, the CVE entry links to details and often to the vendor's fix. This is how "an old version is running" becomes "this exact, named, fixable problem is present".

CVSS: how bad is it?

Knowing a flaw exists is not enough; you need to know how serious it is. CVSS (Common Vulnerability Scoring System) gives a number from 0.0 to 10.0. Higher is worse. The score is built from factors such as how easy it is to exploit and how much damage it does (to confidentiality, integrity and availability).

CVSS scoreSeverity
0.0None
0.1 – 3.9Low
4.0 – 6.9Medium
7.0 – 8.9High
9.0 – 10.0Critical

These bands (as used in CVSS v3.1) let a team sort findings fast: fix the criticals first. In a report, giving each finding a CVSS score and band helps the client prioritise with limited time and budget.

Careful: A high CVSS score is not the same as "exploitable here". Context matters: a critical flaw in a service that is not reachable, or already mitigated, may be lower risk in practice. Always judge the real risk for this client, not just the raw number. And confirm a CVE actually applies to the exact version before you claim it.

Where to look things up

The NVD (National Vulnerability Database) and the CVE programme list CVEs and their CVSS scores. Vendor advisories give the fix. A tester cross-checks these before writing a finding, so the report is accurate and the client can act on it.

Tip: Write findings in the client's language: "an attacker on the internet could run code on this server (CVSS 9.8, critical); update to version X to fix it" is far more useful than just pasting a CVE number.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

CVE and CVSS: naming and scoring weaknesses · 1/7

CVE = the flaw's name

A CVE is a unique public ID for one specific known vulnerability.

Prefer a video by a teacher? Find free videos on “CVE and CVSS explained vulnerability scoring beginners” on YouTube ↗

In real life: From version to priority

During a test, a scanner flags an outdated library with CVE-2021-44228 and a CVSS score of 10.0 (critical). The tester confirms the version really is affected and that the service is reachable, then puts it at the top of the report: critical, fix immediately, here is the vendor patch. A second finding, a low-severity information leak (CVSS 3.1), goes near the bottom. The scores turned a messy list into a clear order of work.

Practice (0/3 done)

Task 1 · Question

A CVE is…

Task 2 · Question

A CVSS score of 9.5 falls in which band (v3.1)?

Task 3 · Code · Python

Write severity(score) that returns the CVSS v3.1 band: "None" for 0.0, "Low" for 0.1–3.9, "Medium" for 4.0–6.9, "High" for 7.0–8.9, "Critical" for 9.0–10.0.

Quick quiz

Question 1

1.CVSS measures…

Question 2

2.The year in CVE-2021-44228 tells you…

Question 3

3.A critical CVSS score always means…

Question 4

4.Where would you confirm a CVE and its score?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

CVSS measures…

Answer: How severe a vulnerability is (0–10)

CVSS scores severity from 0.0 to 10.0.

The year in CVE-2021-44228 tells you…

Answer: The year the CVE was assigned

The middle part is the year.

A critical CVSS score always means…

Answer: It is severe, but you still judge the real risk in context

Severity is high, but reachability and mitigations change the real risk.

Where would you confirm a CVE and its score?

Answer: The NVD and vendor advisories

Cross-check the NVD and vendor advisories.

Why is a CVSS score alone not your risk?Related

Answer: It ignores whether the system is exposed and how important it is to you

CVSS rates the bug in general; your risk also depends on exposure and the value of the asset.

From Threats, vulnerabilities and risk

Vulnerability scanners are strong at…Related

Answer: Broad, fast checks for known issues

They cover many hosts quickly for known issues.

From Vulnerability scanners: OpenVAS and Nessus (concepts)

Evidence in a finding should be…Related

Answer: Minimal proof with no real sensitive data

Minimal proof respects the client and the law.

From The structure of a penetration test report

Which tools scan container images for known vulnerabilities?Related

Answer: Docker Scout and Trivy

Docker Scout and Trivy compare image packages with vulnerability databases. cosign signs images.

From Image and container security

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: Vulnerability scanners: OpenVAS and Nessus (concepts) →

Next steps

  1. 1 more topic in “Enumeration and vulnerability assessment” before its exam: Vulnerability scanners: OpenVAS and Nessus (concepts).
  2. Module 5 exam: enumeration and vulnerability assessment · 12 questions · 20 min, without help. 3 topics of this module still to finish first.
  3. Then the next module, Web application testing: Burp Suite and the basics. 35 topics left in the course before the final exam.

← Previous: Enumeration: digging into services