Gotta Catch 'em All: Aggregating CVSS Scores

TL;DR

This paper introduces a new CVSS aggregation algorithm that considers system context and exploitability factors, improving vulnerability severity assessment by filtering out non-exploitable vulnerabilities.

Contribution

The paper presents a novel CVSS aggregation method incorporating system context, functionality impact, and exploitability, enhancing accuracy over existing aggregation techniques.

Findings

The algorithm effectively filters out non-exploitable vulnerabilities.

Application to OpenPLC V3 demonstrated improved vulnerability assessment.

Results can be interpreted similarly to standard CVSS scores.

Abstract

Security metrics are not standardized, but inter-national proposals such as the Common Vulnerability ScoringSystem (CVSS) for quantifying the severity of known vulnerabil-ities are widely used. Many CVSS aggregation mechanisms havebeen proposed in the literature. Nevertheless, factors related tothe context of the System Under Test (SUT) are not taken intoaccount in the aggregation process; vulnerabilities that in theoryaffect the SUT, but are not exploitable in reality. We propose aCVSS aggregation algorithm that integrates information aboutthe functionality disruption of the SUT, exploitation difficulty,existence of exploits, and the context where the SUT operates.The aggregation algorithm was applied to OpenPLC V3, showingthat it is capable of filtering out vulnerabilities that cannot beexploited in the real conditions of deployment of the particularsystem. Finally, because of the nature of the proposed algorithm,the result can be interpreted in the same way as a normal CVSS.