Black and Blue, or White and Gold? Minimizing Vulnerability Scoring...
summary
Comparison of 80 Cisco CVEs disclosed May–Nov 2023 to NVD rescoring shows most discrepancies come from sparse CVE text, limited product context, a tooling bug that earlier pushed advisory-level worst scores (fixed mid‑2023), and differing CVSS interpretations. A SNORT3 geolocation IP‑filter bypass needed spoofing a specific address—treated as an implementation‑specific secret and rated attack complexity: high and as a scope change by Cisco but not by NVD. Planned fixes: richer summaries explaining required privileges, why complexity or scope apply, outcome over exploit steps, and clearer corner‑case notes.
AI-written summary · about
chapters (15)
- 0:00Vulnerability scoring intro
- 3:19Dress illusion and perception
- 9:02Firewall scoring conflict case
- 13:40CNA vs NVD scoring causes
- 16:14Improving advisory summaries
- 19:07CVSS spec differences
- 21:16Summary and questions
- 21:39Q&A on patterns
- 24:17Balancing detail and clarity
- 26:03Baseline vs technical detail
- 28:08Prioritizing conflicting scores
- 29:31Vendor scoring discrepancies data
- 30:38Team disagreements on scoring
- 32:21Threat intel in scoring
- 33:50Final Q&A and closing
related talks
50mCVSS v4.0 By The Numbers
29mDiving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?
24mSecurity Advisories and Vulnerability Prioritization in the Wild
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
51mWhen it Comes to Managing Risk, Context is King