CVE & Vulnerability Language | Security Lab Exercises

1 / 5

A CVE advisory reads: "CVSS Base Score: 9.8 (Critical) — CVE-2024-XXXXX: A remote, unauthenticated attacker can execute arbitrary code via a specially crafted HTTP request."

What does CVSS stand for, and what does the score of 9.8 indicate?

CVSS = Common Vulnerability Scoring System. A score of 9.8 is Critical — near the maximum of 10.0.

CVSS Score Range	Severity	Action expected
0.1 – 3.9	Low	Patch in next planned maintenance window
4.0 – 6.9	Medium	Patch within 30–90 days
7.0 – 8.9	High	Patch within 7–30 days
9.0 – 10.0	Critical	Patch immediately — emergency change process

Key vocabulary in this advisory:

Remote unauthenticated attacker — no credentials or network proximity needed; exploitable from the internet
Arbitrary code execution — attacker can run any code they choose on the target system
Specially crafted request — a deliberately malformed or weaponised HTTP request that triggers the vulnerability

2 / 5

A security blog post states: "The vulnerability was reported under responsible disclosure."

What does responsible disclosure mean?

Responsible disclosure (also called coordinated vulnerability disclosure) = researcher notifies vendor privately first, waits for a patch, then discloses publicly.

Disclosure type	Process	Risk
Responsible / Coordinated	Notify vendor → wait for patch → disclose publicly	Low — vendor has time to protect users before details are public
Full disclosure	Immediate public release of all details and exploit	High — attackers can weaponise before patch is available
Bug bounty program	Vendor-run programme; researcher submits privately and receives reward	Low — incentivises responsible reporting

Key vocabulary:

Embargo period — the agreed window (usually 90 days per Google Project Zero policy) during which details are kept private while a patch is prepared
Coordinated disclosure — synonym for responsible disclosure, emphasising collaboration between researcher and vendor
90-day disclosure deadline — after 90 days, the researcher may disclose publicly even if no patch exists

3 / 5

A security bulletin reads: "This is a 0-day exploit actively being used in the wild."

What does "0-day" mean in this context?

0-day (zero-day) = the vulnerability is being exploited BEFORE the vendor knows about it or has issued a patch. Defenders have had zero days to protect themselves.

Term	Meaning	Patch available?
0-day (zero-day)	Exploited before vendor awareness or patch	No
n-day	Known CVE with an existing patch; exploited because unpatched	Yes — not applied
In the wild	Actively exploited by real threat actors in real attacks (not just proof-of-concept)	—

Why 0-days are especially dangerous: No patch exists, so traditional patch management cannot protect you. Defenders must rely on behavioural detection, network segmentation, and threat hunting rather than signature-based or patch-based controls.

4 / 5

A security tracker shows: "The vendor has marked this CVE as a duplicate of CVE-2023-XXXXX."

What does this indicate?

CVE duplication = the same underlying vulnerability was reported under two different CVE IDs. The later entry is marked as a duplicate pointing to the earlier "canonical" CVE.

CVE state	Meaning
Reserved	CVE ID has been allocated but details are not yet public (under embargo or pending analysis)
Published	CVE is public with full details and CVSS score in the NVD
Duplicate	Same vulnerability already tracked under another CVE; this entry now references the canonical CVE
Rejected / Disputed	Entry withdrawn — vulnerability was not present, duplicate, or reported in error

Key vocabulary: "reserved", "duplicate", "canonical CVE", "NVD enrichment" (analysis and CVSS scoring added by NIST after the CVE is published by MITRE).

5 / 5

A security researcher writes in their report: "The attack vector is Network, attack complexity is Low, privileges required is None, user interaction is None."

Which section of a CVE advisory are these attributes from?

These are CVSS v3 base metric attributes. Together they produce the vector string and numerical score.

Attribute	Options	Why it matters
Attack Vector (AV)	Network / Adjacent / Local / Physical	Network = remotely exploitable from internet → highest score
Attack Complexity (AC)	Low / High	Low = no special conditions required → higher score
Privileges Required (PR)	None / Low / High	None = unauthenticated exploit → highest score
User Interaction (UI)	None / Required	None = no victim action needed → higher score

Example vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = Critical 9.8 — remote, no auth, no complexity, full confidentiality/integrity/availability impact.

Reading CVSS vector strings is an essential skill for triaging vulnerabilities in security bulletins and dependency scanning reports.