Learn to write clear security advisories: CVE IDs, affected versions, severity, mitigation language, and standard disclosure phrases.
0 / 21 completed
1 / 21
What is a CVE ID, and what does it look like in a security advisory?
CVE (Common Vulnerabilities and Exposures) IDs are assigned by CVE Numbering Authorities (CNAs) — large vendors like Microsoft, Google, and Red Hat are CNAs and can assign their own CVE IDs. The format is CVE-[year]-[sequential number]. CVE IDs are referenced in NVD (National Vulnerability Database), security scanners (Trivy, Snyk), and patch management tools, making them the universal language for vulnerability communication.
2 / 21
What should the 'affected versions' section of a security advisory specify?
Precise version ranges are essential for actionability: 'versions >= 1.0.0 and < 2.4.4 are affected.' Operators and automated scanners (Dependabot, Renovate, Snyk) parse this to determine if a dependency in use is vulnerable. Vague language ('older versions may be affected') is inadequate — users cannot determine exposure and may not upgrade unnecessarily or fail to upgrade when needed.
3 / 21
What does 'no known exploits in the wild' mean in a security advisory?
'No known exploits in the wild' (sometimes 'no evidence of exploitation in the wild') is a standard advisory phrase indicating exploitation status at publication time. It is a snapshot, not a permanent status — a vulnerability can go from unexploited to actively exploited within days of advisory publication when exploit code is developed. It provides context for prioritisation: patches for unexploited vulnerabilities may have a longer remediation window than actively exploited ones.
4 / 21
What is the correct phrasing for recommending a patch in a security advisory?
'Update to version X or later to fix this issue' is the canonical mitigation recommendation. It specifies the action (update), the target (version X or later), and the outcome (fixes this issue). If a patch is not yet available, include a workaround: 'Until the patch is available, disable feature Y or restrict access to endpoint Z.' Vague language like 'consider upgrading' reduces urgency and compliance.
5 / 21
What is the 'mitigation' section of a security advisory?
The mitigation section answers: 'What should I do right now?' It should include: (1) definitive fix — 'upgrade to version X'; (2) workarounds if no patch is available — 'disable the affected endpoint', 'set configuration option Y to Z'; (3) compensating controls — 'ensure this service is not exposed to the internet'. Multiple mitigations should be ordered from most to least effective. Good advisories include both immediate and long-term mitigations.
6 / 21
Alex from the security team just posted this comment on a code review: 'This function uses `fgets` directly – we need to sanitize user input *before* calling it. It's a classic buffer overflow vulnerability waiting to happen.' What does sanitize mean in this context?
The term 'sanitize' refers to the process of removing or modifying potentially harmful elements from data. In this case, it means cleaning user input—like what a user might type into a form—to prevent malicious code injection or vulnerabilities like buffer overflows when used in functions like fgets. It's about proactive defense, not automatic fixes or simply replacing the function.
7 / 21
Sarah is drafting a security advisory for a newly discovered vulnerability in their web server. She's writing the 'Affected Versions' section. Which of the following statements best describes what this section should include?
The 'Affected Versions' section is crucial for targeted patching. It needs to clearly define the scope of the vulnerability by listing *specific* software versions where it exists. This allows users to accurately identify which systems require immediate attention and avoids unnecessary patching of unaffected systems. A broad statement like 'any version' would be ineffective.
8 / 21
Ben is writing a security advisory for a critical vulnerability in a popular image processing library. He includes the following sentence: 'No known exploits have been identified in the wild.' What does this statement *primarily* indicate?
The phrase 'no known exploits in the wild' is a key reassurance. It means that while the vulnerability exists and could theoretically be exploited, there's currently no evidence of active attacks using it. This doesn't eliminate the risk entirely, but it suggests the immediate threat level is lower than if attackers were actively leveraging the flaw.
9 / 21
Liam from the security team is drafting a Slack message to inform developers about a newly discovered vulnerability in the FastAPI framework. He writes: 'We've identified a potential race condition during JWT validation. Users with sufficient privileges can potentially bypass authentication checks. Please review your API endpoints and ensure proper input validation.' Which of the following best describes Liam's primary goal with this message?
Liam's message aims to raise awareness and prompt action. It avoids overly technical details that might overwhelm less experienced developers while clearly stating the risk and encouraging preventative measures. The incorrect options focus on documentation or demanding immediate fixes without sufficient context – a key element of effective security communication.
10 / 21
Maya is creating the 'Mitigation' section of a security advisory for a SQL injection vulnerability in their e-commerce platform. Which of the following statements best reflects the appropriate content for this section?
The 'Mitigation' section focuses on *practical* steps developers can take. Parameterized queries and input validation are standard defenses against SQL injection. The other options represent overly broad or non-technical responses that wouldn't be helpful in a security advisory aimed at developers. It is crucial to provide actionable solutions.
11 / 21
David is writing the description for a Pull Request (PR) that fixes a Cross-Site Scripting (XSS) vulnerability in their web application. He includes the following text: 'This PR addresses a potential XSS vulnerability by escaping all user input before rendering it in the browser. This prevents malicious scripts from being injected and executed.' What is the *most* important reason for including this specific detail about escaping user input?
The core purpose of describing a security fix is to clearly communicate *why* the change was made. Highlighting the potential impact (XSS vulnerabilities) reinforces the seriousness of the issue and justifies the defensive measure – escaping user input – which is the primary technique for preventing XSS attacks. Option A is about compliance, B is a secondary benefit, and C focuses on review rather than prevention.
12 / 21
Chloe is participating in a standup meeting and mentions that her team discovered a vulnerability related to deserializing untrusted data. She states: 'We're seeing potential issues with unserialized objects, which could lead to remote code execution.' What immediate action should Chloe recommend the team take?
Given the severity of remote code execution (RCE), immediate action is crucial. Deploying a patch represents the fastest way to mitigate the risk, even if it's not a fully comprehensive solution. The other options represent delayed or ineffective responses – delaying patching allows the vulnerability to remain active and potentially exploited. Further investigation and stricter validation are important *after* applying a temporary fix.
13 / 21
David, a security engineer, is writing the description for a Pull Request (PR) that fixes a Cross-Site Scripting (XSS) vulnerability in their web application. He includes the following text: 'This PR addresses a potential XSS vulnerability by escaping all user-supplied data before rendering it within the HTML output.' Which of the following best describes the primary purpose of this phrasing?
A. It completely eliminates the risk of XSS, regardless of how the data is ultimately used.
B. It represents a standard defense-in-depth approach, mitigating the vulnerability by carefully controlling output to the browser.
C. It solely focuses on preventing attacks targeting users with malicious JavaScript code.
D. It guarantees that all user input will be treated as safe and untrusted.
The correct answer is B. Escaping user-supplied data before rendering it in HTML is a fundamental XSS mitigation technique – a defense-in-depth approach. Options A, C, and D are misleading; escaping doesn't eliminate all risks, nor does it solely target JavaScript attacks, and it certainly doesn't guarantee safe input.
14 / 21
Liam from the security team is drafting a Slack message to inform developers about a newly discovered vulnerability in the FastAPI framework. He writes: 'We've identified a potential race condition during JWT validation. It's crucial to update immediately!' What does the phrase 'update immediately!' primarily convey in this context?
A. The vulnerability is only exploitable within a specific timeframe.
B. The vulnerability is critical and requires urgent patching or mitigation steps to prevent exploitation.
C. The JWT validation process itself needs to be completely redesigned.
D. Developers should immediately stop using the FastAPI framework altogether.
Option B accurately reflects the urgency implied by 'update immediately!' when discussing a critical vulnerability. This phrase indicates that immediate action is necessary – patching or applying mitigation steps – to prevent potential exploitation. The other options represent more specific technical actions rather than conveying the overall sense of urgency.
15 / 21
Alex from the security team just posted this comment on a code review: 'This function uses fgets directly – we need to sanitize user input *before* calling it. It's a classic buffer overflow vulnerability waiting to h…'. What is the primary reason for Alex's concern regarding the use of fgets with unsanitized user input?
A. The function will automatically prevent any malicious code from being executed.
B. The function could be exploited to overwrite adjacent memory locations, leading to unpredictable behavior or security breaches.
C. The function is poorly written and should be refactored for improved readability.
D. The function uses an outdated version of the C library.
Option B accurately describes the core risk associated with using `fgets` directly with untrusted input – a classic buffer overflow vulnerability. The lack of input validation allows a malicious user to provide data that exceeds the allocated buffer size, causing data corruption and potential security breaches. Options A, C, and D are irrelevant to the primary issue.
16 / 21
Maya is creating the 'Mitigation' section of a security advisory for a SQL injection vulnerability in their e-commerce platform. Which of the following statements best reflects the appropriate content for this section?
A. Implementing a complex firewall to block all external network traffic.
B. Using parameterized queries or prepared statements to prevent malicious code from being interpreted as SQL commands.
C. Regularly auditing the database schema and user permissions.
D. Deploying intrusion detection systems to monitor for suspicious activity.
Option B is correct because using parameterized queries or prepared statements is the standard mitigation technique for SQL injection vulnerabilities. These methods treat user input as data rather than executable code, preventing attackers from injecting malicious SQL commands. The other options represent broader security measures but don't directly address the vulnerability itself.
17 / 21
Context: You're reviewing a PR that implements a new feature using a third-party library. The security team has flagged a potential vulnerability related to improper input validation. Here's the PR description:
'This PR adds support for importing data from external CSV files. It uses the pandas library to parse these files.'
Which of the following is the MOST appropriate comment you should add to the PR, focusing on a security advisory perspective?
The correct answer highlights the crucial need for input sanitization when dealing with external data sources. Failing to sanitize CSV files can lead to vulnerabilities like SQL injection or code execution. Options A and B directly address this concern, while option C is overly confident and option D ignores the potential risk entirely.
18 / 21
Context: You're drafting a Slack message to inform developers about a newly discovered vulnerability in a microservice that handles user authentication. The vulnerability is related to insufficient rate limiting.
Which of the following statements best describes what should be included in your Slack message?
A good security advisory Slack message focuses on the potential impact of a vulnerability (DoS) and guides users on monitoring and reporting. Option A demands immediate action without providing context, option C dismisses developer involvement, and option D suggests the problem is resolved when it's still a risk.
19 / 21
Context: You are writing the 'Mitigation' section of a security advisory for a vulnerability in a logging library that allows attackers to inject arbitrary code. The vulnerability is due to insufficient input validation.
Which of the following statements best reflects an appropriate recommendation?
The correct response emphasizes the core principle of input validation – preventing malicious code from being injected. Option A is too restrictive, option B is overly drastic, and option D falsely assumes a fix has been implemented. Escaping user-supplied data is a common technique but doesn't address the root cause.*
20 / 21
Context: You are reviewing a Pull Request (PR) that fixes a vulnerability in a web application. The PR description states: 'This PR addresses a potential cross-site scripting (XSS) vulnerability by implementing proper output encoding.'
What is the MOST important follow-up question to ask the developer during code review?
The correct answer focuses on verifying the implementation of output encoding – a critical mitigation strategy for XSS. While other options are relevant to code review, confirming the specific implementation is paramount to ensuring the vulnerability has been correctly addressed.
21 / 21
Context: You're composing a security advisory for a newly discovered issue in a configuration management tool. The vulnerability allows unauthorized access to sensitive system credentials.
Which of the following statements is MOST critical to include in the 'Affected Versions' section?
Clearly defining the affected version range is absolutely essential for accurate patching and risk assessment. Providing overly broad statements (like 'all versions') or focusing on specific OS types creates confusion and hinders effective mitigation. The privilege level of an attacker is irrelevant to the vulnerability itself.*
What will I learn from the "Writing Security Advisories — Vocabulary" exercise?
Learn to write clear security advisories: CVE IDs, affected versions, severity, mitigation language, and standard disclosure phrases.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 21 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Security Disclosure Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss security disclosure language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 21 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Security Disclosure Language exercises?
See the full Security Disclosure Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.