Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities (2308.15259v2)

Abstract: The Common Vulnerability Scoring System (CVSS) is a popular method for evaluating the severity of vulnerabilities in vulnerability management. In the evaluation process, a numeric score between 0 and 10 is calculated, 10 being the most severe (critical) value. The goal of CVSS is to provide comparable scores across different evaluators. However, previous works indicate that CVSS might not reach this goal: If a vulnerability is evaluated by several analysts, their scores often differ. This raises the following questions: Are CVSS evaluations consistent? Which factors influence CVSS assessments? We systematically investigate these questions in an online survey with 196 CVSS users. We show that specific CVSS metrics are inconsistently evaluated for widespread vulnerability types, including Top 3 vulnerabilities from the "2022 CWE Top 25 Most Dangerous Software Weaknesses" list. In a follow-up survey with 59 participants, we found that for the same vulnerabilities from the main study, 68% of these users gave different severity ratings. Our study reveals that most evaluators are aware of the problematic aspects of CVSS, but they still see CVSS as a useful tool for vulnerability assessment. Finally, we discuss possible reasons for inconsistent evaluations and provide recommendations on improving the consistency of scoring.

• The paper identifies significant scoring inconsistencies in CVSS v3.1, especially in the evaluation of Attack Vector, User Interaction, and Scope.
• The study uses a survey of 196 users with a follow-up evaluation to quantify variability in assessing key CVSS metrics.
• The findings highlight the need for improved documentation and more accessible guidance to enhance the consistency of vulnerability assessments.

Analyzing the Consistency and Usability of CVSS v3.1 in Vulnerability Assessment

Introduction to CVSS Practice and Challenges

The Common Vulnerability Scoring System (CVSS) is an established methodology for evaluating the severity of security vulnerabilities. It is crucial in informing vulnerability management by providing a standardized severity score that organizations globally rely on for their security processes. This essay analyzes a paper examining the consistency of CVSS v3.1 scores assigned by different evaluators, shedding light on the subjectivity and potential inconsistencies inherent in this critical tool.

Overview of Study Design

The paper involved a survey of 196 users actively engaged in CVSS assessments (Figure 1). Participants evaluated specific vulnerabilities, allowing the researchers to quantify the consistency of metric evaluation across various vulnerability types. The paper also included a follow-up survey nine months later to assess temporal consistency among the same evaluators.

Figure 1: Overview of paper design ($N$ = number of participants).

Inconsistencies in CVSS Scoring

The analysis revealed notable inconsistencies in assessing several CVSS metrics, particularly Attack Vector, User Interaction, and Scope, across widely referenced vulnerability types.

Metric Evaluation and Inconsistencies

• Attack Vector (AV): Variations emerged, such as between Network (AV:N) and Local (AV:L) contexts in Drive-by Download vulnerabilities. The discrepancies were evident in how evaluators perceived network involvement, mirroring guidance ambiguities.
• User Interaction (UI): Evaluation inconsistencies arose primarily with Stored and Reflected Cross-Site Scripting (XSS) vulnerabilities. Evaluators diverged on whether User Interaction was required, highlighting comprehension gaps in official documentation.
• Scope (S): The Scope metric appeared particularly problematic. Consistent application of S:U versus S:C distinctions was rare, indicating complications in understanding the metric's theoretical and practical application (Figure 2).

  Figure 3: Evaluations of the Attack Vector and User Interaction metric.

  

  Figure 4: Evaluations of the Scope metric.

Effects of Evaluator Background and Documentation

Regression analysis showed evaluator background had minimal impact on scoring consistency, suggesting systemic issues within CVSS itself. Notably, high familiarity with official documentation contributed positively to scoring accuracy. However, many evaluators leaned heavily on quick-reference tools over thorough consultative documents due to accessibility issues.

Working Environment:

Respondents typically completed vulnerability assessments within five minutes, generally relying on online calculators. This rapid cadence may detract from thorough metric consideration, leading to observed scoring inconsistencies.

Perception and Usage of CVSS

Despite noted inconsistencies, participants broadly acknowledged CVSS’s critical role. The perceived utility outweighed its drawbacks, with users finding value in its standardization aspect, essential for industry-wide communication (Figure 5).

Figure 5: RQ2: Severity distributions of the vulnerabilities. Security deficiencies Banner Disclosure and HTTPOnly are more frequently rated with None than other vulnerabilities.

Attitudinal Insights:

Evaluators acknowledged CVSS as indispensable, with broad acceptance of its use, albeit with recognition of its flaws. The potential misuse of CVSS was apparent, with instances where secondary mitigations were overrated compared to more severe vulnerabilities. These issues defend a drive toward enhanced clarity and improved guidelines in CVSS documentation.

Implications for Future CVSS Development

The paper advocates significant documentation revisions and improved tool accessibility (e.g., integrating comprehensive guidance into online calculators). Further targeted research is recommended to address underexplored metrics and contextual scenarios not covered in this paper.

Future Work Recommendations:

Enhanced empirical scrutiny on CVSS documentation barriers and integrating expansive contextual considerations could fortify the framework. Collaboratively revisiting CVSS metrics—especially Scope—should be prioritized for future enhancements.

Conclusion

This paper highlights significant consistency issues within the CVSS v3.1 framework, emphasizing the need for improved documentation accessibility and refined metric definitions. Although inconsistencies persist, CVSS remains a pivotal tool within vulnerability management, demanding continuous refinement to sustain its vital role in global cybersecurity efforts.