I’m a bit late writing about the release of the new Common Vulnerability Scoring System  CVSS 2.0 released earlier this month.
It is a valuable addition to the  already established MITRE OVAL Open Vulnerability and Assessment Language and WASC Web Security Threat Classification.

The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and impacts of IT vulnerabilities. CVSS consists of 3 groups: Base, Temporal and Environmental. Each group produces a numeric score ranging from 0 to 10, and a Vector, a compressed textual representation that reflects the values used to derive the score.

• The Base group represents the intrinsic qualities of a vulnerability. 
• The Temporal group reflects the characteristics of a vulnerability that change over time. 
• The Environmental group represents the characteristics of a vulnerability that are unique to any user’s environment. 

CVSS enables IT managers, vulnerability bulletin providers, security vendors, application vendors and researchers to all benefit by adopting this common language of scoring IT vulnerabilities.

I’m glad to see that ArcSight, one of my favorite security vendors, is one of the CVSS Adopters

Share This

If you enjoyed this post, make sure you subscribe to my RSS feed!