Learn to read and write CVE descriptions, CVSS scoring language, and security advisory communication.
0 / 14 completed
1 / 14
A CVE (Common Vulnerabilities and Exposures) entry describes:
A CVE entry (e.g., CVE-2021-44228 for Log4Shell) identifies and standardises a specific vulnerability — enabling consistent reference across vendors, tools, and advisories.
2 / 14
A CVSS score of 9.8 (Critical) indicates:
CVSS 9.0-10.0 is Critical: typically network-exploitable, no authentication required, and high impact across all three CIA (Confidentiality, Integrity, Availability) dimensions.
3 / 14
In a security advisory, 'affected versions' specifies:
Affected versions allow organisations to quickly determine if their installations are vulnerable — the first question when responding to any advisory.
4 / 14
A 'workaround' in a security advisory means:
Workarounds (disabling a feature, blocking a port, adding WAF rules) reduce risk while awaiting a full patch — important for zero-day advisories where patches may take days.
5 / 14
CVSS 'attack vector: Network' means the vulnerability can be exploited:
Network attack vector means the vulnerability is remotely exploitable via the internet — the most dangerous attack vector, as it allows any attacker globally to attempt exploitation.
6 / 14
Reviewer: 'I've flagged a potential issue in PR #1234. The `validate_user()` function appears to be vulnerable to SQL injection if the input string isn't properly sanitized. Specifically, it's using string concatenation instead of parameterized queries. This could allow an attacker to execute arbitrary database commands. Please investigate and implement a fix.
Which of the following responses best addresses this comment during a code review discussion?
The correct response is to request clarification. While SQL injection *is* a serious concern (highlighted in the comment), simply accepting or reverting without understanding the developer's reasoning isn't productive. This demonstrates a collaborative approach and allows for a more targeted discussion about the specific vulnerability and potential solutions, crucial when discussing security concerns with colleagues. Options A and D are insufficient because they don't address the core technical issue, while option B is overly dismissive of a potentially exploitable weakness.
7 / 14
Reviewer: 'I've flagged a potential issue in PR #1234. The `validate_user()` function appears to be vulnerable to SQL injection if the input string isn't properly sanitized. Specifically, it's using string concatenation instead of parameterized queries. This could allow an attacker to execute arbitrary database commands. Please investigate and implement a fix.
Which of the following responses best addresses this comment during a code review discussion?
The correct response is to request clarification. While SQL injection *is* a serious concern (highlighted in the comment), simply accepting or reverting without understanding the developer's reasoning isn't productive. This demonstrates a collaborative approach and allows for a more targeted discussion about the specific vulnerability and potential solutions, crucial when discussing security concerns with colleagues. Options A and D are insufficient because they don't address the core technical issue, while option B is overly dismissive of a potentially exploitable weakness.
8 / 14
Reviewer: 'I've flagged a potential issue in PR #1234. The `validate_user()` function appears to be vulnerable to SQL injection if the input string isn't properly sanitized. Specifically, it's using string concatenation instead of parameterized queries. This could allow an attacker to execute arbitrary database commands. Please investigate and implement a fix.
Which of the following responses best addresses this comment during a code review discussion?
The correct response is to request clarification. While SQL injection *is* a serious concern (highlighted in the comment), simply accepting or reverting without understanding the developer's reasoning isn't productive. This demonstrates a collaborative approach and allows for a more targeted discussion about the specific vulnerability and potential solutions, crucial when discussing security concerns with colleagues. Options A and D are insufficient because they don't address the core technical issue, while option B is overly dismissive of a potentially exploitable weakness.
9 / 14
Reviewer: 'I've flagged a potential issue in PR #1234. The `validate_user()` function appears to be vulnerable to SQL injection if the input string isn't properly sanitized. Specifically, it's using string concatenation instead of parameterized queries. This could allow an attacker to execute arbitrary database commands. Please investigate and implement a fix.
Which of the following responses best addresses this comment during a code review discussion?
The correct response is to request clarification. While SQL injection *is* a serious concern (highlighted in the comment), simply accepting or reverting without understanding the developer's reasoning isn't productive. This demonstrates a collaborative approach and allows for a more targeted discussion about the specific vulnerability and potential solutions, crucial when discussing security concerns with colleagues. Options A and D are insufficient because they don't address the core technical issue, while option B is overly dismissive of a potentially exploitable weakness.
10 / 14
Slack message from Sarah (Security Lead) to the team: 'Hey all, we've received a security advisory regarding a potential remote code execution vulnerability in our API gateway. The advisory recommends upgrading to version 2.5.1 or later. Please review your deployments and prioritize this update.' Which of the following best describes the *primary* purpose of Sarah's message?
Sarah's message is focused on communication – it directs the team to *take* action. The 'security advisory' provides the technical details, which would be referenced in that advisory. A critical update request is implied, but not explicitly stated; Sarah's role is to escalate and guide response.
11 / 14
During a code review, John comments on PR #5678: 'The `get_user_profile()` endpoint doesn't handle potentially malicious input correctly. While the CNAME function is used for string manipulation, it lacks proper validation against common SQL injection patterns. The CVSS score associated with this vulnerability is 8.6 (High).' What does John *primarily* highlight in his comment?
John is focusing on a *technical* vulnerability: the SQL injection risk. He's also referencing the CVSS score (8.6) to emphasize the significance of this flaw. His comment isn't about general policies or testing; it's about identifying and flagging a specific security issue.
12 / 14
In a PR description for a fix to a CVE (CVE-2023-4567), the developer writes: 'This update addresses a critical vulnerability allowing unauthorized access due to improper input sanitization. The affected component is the `process_payment()` function. The advisory states that users should immediately upgrade to version 1.2 or later.' What does the phrase 'affected component' in this description refer to?
'Affected component' precisely identifies *where* the vulnerability resides – in this case, the `process_payment()` function. It's about narrowing down the scope of the issue to the specific part of the system that was compromised.
13 / 14
A security advisory for a vulnerability in a web application states: 'To mitigate this risk, users are advised to implement the following workaround: temporarily disable the 'Advanced Search' feature until a permanent fix is deployed.' What does this 'workaround' primarily represent?
Workarounds are *temporary* solutions. They're implemented when a permanent fix isn't immediately available and aim to reduce the immediate risk – essentially buying time until a proper patch can be released. It's not about rolling back or formally requesting a patch.
14 / 14
During a standup meeting, David (Developer) says: 'I'm working on patching CVE-2024-9876. The CVSS score is 7.5 (High), and the attack vector is Network.' What does the 'attack vector: Network' classification *primarily* indicate about this vulnerability?
'Attack vector: Network' means the vulnerability's exploitation doesn't require direct interaction with the affected system. It signifies that an attacker can trigger the vulnerability remotely through network traffic – typically via a crafted HTTP request or similar mechanism.
What does the "CVE & Security Advisory Language" exercise practise?
Learn to read and write CVE descriptions, CVSS scoring language, and security advisory communication.
How many questions are in this exercise?
This exercise has 14 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Cybersecurity category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "CVE & Security Advisory Language" part of a larger series?
Yes — it's one exercise in the Cybersecurity category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Cybersecurity category page for related exercises, or browse the main Exercises hub for other IT English topics.