Deriving CVSS from Multi-Scenario Attack Graphs: A Reproducible, Auditable Scoring Method
summary
Claims a reproducible, auditable method that builds attack graphs represented in JSON and graph-based JSON model to enumerate every delivery/exploitation path, attach node-level properties (proximity, privileges, conditions, impacted system) and then programmatic CVSS derivation to output per-scenario vectors. Demonstrations include a Wireshark Bluetooth variant, a desktop app crash-report leak of Wi‑Fi credentials, a PDF reader with plugin vs local import, and a Grafana XSS vs SSRF split, showing automated derivation picks the actual worst-case scenario and removes Frankenstein vectors.
AI-written summary · about
chapters (11)
- 0:00CVSS subjectivity and automation
- 3:42AI attempts at CVSS scoring
- 6:13Inconsistent CVSS scoring causes
- 10:05Graph-based reproducible scoring
- 16:02Modeling attack scenarios with graphs
- 18:11Desktop app vulnerability scoring
- 19:54PDF reader vulnerability analysis
- 22:00Grafana vulnerability evaluation
- 24:05Graph-based CVSS benefits
- 25:29Attack graphs beyond CVSS
- 26:11Q&A on CVSS scoring
related talks
31mValidating Vulnerability Analysis with Statistical Analysis of Metadata
01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers
37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives
32mExploit Maturity: Your New Best Friend in CVSS
45mVulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
15mKeynote