Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities

Wunder J, Kurtz A, Eichenmüller C, Gassmann F, Benenson Z (2024)

Publication Language: English

Publication Type: Conference contribution

Publication year: 2024

Publisher: IEEE

City/Town: New York City

Pages Range: 1102-1121

Conference Proceedings Title: 2024 IEEE Symposium on Security and Privacy (SP)

Event location: San Francisco, CA US

ISBN: 9798350331301

DOI: 10.1109/SP54263.2024.00058

Abstract

The Common Vulnerability Scoring System (CVSS) is a popular method for evaluating the severity of vulnerabilities in vulnerability management. In the evaluation process, a numeric score between 0 and 10 is calculated, 10 being the most severe (critical) value. The goal of CVSS is to provide comparable scores across different evaluators. However, previous works indicate that CVSS might not reach this goal: If a vulnerability is evaluated by several analysts, their scores often differ. This raises the following questions: Are CVSS evaluations consistent? Which factors influence CVSS assessments? We systematically investigate these questions in an online survey with 196 CVSS users. We show that specific CVSS metrics are inconsistently evaluated for widespread vulnerability types, including Top 3 vulnerabilities from the "2022 CWE Top 25 Most Dangerous Software Weaknesses"list. In a follow-up survey with 59 participants, we found that for the same vulnerabilities from the main study, 68% of these users gave different severity ratings. Our study reveals that most evaluators are aware of the problematic aspects of CVSS, but they still see CVSS as a useful tool for vulnerability assessment. Finally, we discuss possible reasons for inconsistent evaluations and provide recommendations on improving the consistency of scoring.

Authors with CRIS profile

Julia Wunder Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Christian Eichenmüller Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Zinaida Benenson Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)

Involved external institutions

Hochschule Heilbronn DE Germany (DE) Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau (RPTU) DE Germany (DE)

How to cite

APA:

Wunder, J., Kurtz, A., Eichenmüller, C., Gassmann, F., & Benenson, Z. (2024). Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities. In 2024 IEEE Symposium on Security and Privacy (SP) (pp. 1102-1121). San Francisco, CA, US: New York City: IEEE.

MLA:

Wunder, Julia, et al. "Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities." Proceedings of the 45th IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA New York City: IEEE, 2024. 1102-1121.

BibTeX: Download