Ask Not Whether CVSSv3.1 and v4 Scores are Inconsistent, But What Can You Do About It
summary
Paper analyzes inconsistencies between CVSS v3.1 and v4 using over 2,000+ public and 6,000+ private CVEs, finds large divergence for user interaction and impact (example: 22.1% UI mismatch in public data, 26.7% impact inconsistency in one company), tests ChatGPT for automated scoring and finds it reproduces wild inconsistencies (ChatGPT fails to reconcile), defines one-to-one / one-to-many / many-to-many mappings and a rules-of-thumb for simultaneous scoring that cuts most mismatches but leaves ~3.3% residual conflicts.
AI-written summary · about
chapters (9)
- 0:00CVSS inconsistency research intro
- 1:05Evidence of CVSS inconsistencies
- 2:28Root causes of rating gaps
- 5:13CVSS v4.0 new features
- 8:50v3.1 vs v4.0 rating gaps
- 10:39Cross-version consistency rules
- 17:23Rules tested on real datasets
- 19:48Conclusion and open questions
- 21:20Q&A
related talks
01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
35mBlack and Blue, or White and Gold? Minimizing Vulnerability Scoring...
29mDiving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...
57mFIRST SIG Updates
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?