Lesson 2.68: Reading security advisories: CVE, CVSS and known exploitation
Every week vendors publish dozens of security advisories. A CVE number names a vulnerability, a CVSS score from 0 to 10 says how bad it could be, and catalogues such as CISA's Known Exploited Vulnerabilities (KEV) say whether attackers are already using it. None of these alone tells you what to patch first: that also depends on whether you run the product, which version, and whether it faces the internet. In the lab you read this week's advisories, compare them with Northwind's inventory and write a patch plan in the right order.
17 min
You will learn to
- Explain what a CVE identifier is
- Read a CVSS score and its severity band
- Explain why known exploitation (KEV) raises priority
- Match advisories against an inventory
- Order patches by severity, exploitation and exposure
Key terms
- CVE
- Common Vulnerabilities and Exposures: a public ID for one vulnerability, like CVE-2021-44228.
- CVSS
- Common Vulnerability Scoring System: a 0-10 score of how severe a vulnerability could be.
- KEV
- CISA's Known Exploited Vulnerabilities catalogue: vulnerabilities attackers are using now.
- Advisory
- A vendor's notice describing a vulnerability, affected versions and the fix.
- Exposure
- Whether a system can be reached by an attacker, e.g. from the internet.
← Stolen sessions: MFA bypass with AiTM phishing and infostealers · All lessons · CIS Controls v8: an IG1 self-assessment →