- play_arrow What's New for Users in JSA Vulnerability Manager 7.4.0
- play_arrow Installations and Deployments
- Installations and Deployments
- Vulnerability Backup and Recovery
- Ports Used for Communication Between JSA and JSA Vulnerability Manager Managed Hosts
- Options for Moving the Vulnerability Processor in Your JSA Vulnerability Manager Deployment
- Options for Adding Scanners to Your JSA Vulnerability Manager Deployment
- JSA Vulnerability Manager High-availability Scans
- Extending the JSA Vulnerability Manager Temporary License Period
- JSA Vulnerability Manager High-availability Scans
- play_arrow Overview Of JSA Vulnerability Manager
- play_arrow Vulnerability Scanning Strategy and Best Practices
- Vulnerability Scanning Strategy and Best Practices
- Scan Policy Types
- Scan Duration and Ports Scanning
- Tune Your Asset Discovery Configuration
- Tune Your Asset Discovery Performance
- Web Application Scanning
- Scanner Placement in Your Network
- Dynamic Scanning
- Network Bandwidth for Simultaneous Asset Scans
- Network Interface Cards on Scanners
- Vulnerability Management for Asset Owners
- Vulnerability Scan Notifications
- Triggering Scans of New Assets
- Configuring Environmental Risk for an Asset
- External Scanning FAQs
- play_arrow Scan Configuration
- play_arrow False Positives Management
- play_arrow Authenticated Patch Scans
- play_arrow Scanning on Windows-based Assets
- Scanning on Windows-based Assets
- Configuring an Authenticated Scan Of the Windows Operating System
- Remote Registry
- Enabling Remote Registry Access to Assets on the Windows Operating System
- Assigning Minimum Remote Registry Permissions
- Configuring WMI
- Setting Minimum DCOM Permissions
- Setting DCOM Remote Access Permissions
- Administrative Shares
- Enabling Administrative Shares
- Disabling Administrative Shares
- Manually Configuring NTLMv2 Authentication to Prevent Scan Failures
- play_arrow Vulnerability Exception Rules
- play_arrow Scan Investigations
- Scan Investigations
- Searching Scan Results
- Including Column Headings in Asset Searches
- Managing Scan Results
- Republishing Scan Results
- Asset Risk Levels and Vulnerability Categories
- Asset, Vulnerability, and Open Services Data
- Viewing the Status Of Asset Patch Downloads
- Vulnerability Risk and PCI Severity
- Troubleshooting Scan Issues
- Emailing Asset Owners When Vulnerability Scans Start and Stop
- play_arrow Vulnerability Remediation
- play_arrow Vulnerability Reports
- play_arrow Scanning New Assets That Communicate with the Internet
- Scanning New Assets That Communicate with the Internet
- Creating an Asset Saved Search for New Assets
- Creating an On-demand Scan Profile
- Creating a Policy Monitor Question to Test for Internet Communication
- Monitoring Communication Between New Assets and the Internet
- Configuring an Offense Rule to Trigger a Scan
- play_arrow Security Software Integrations
- play_arrow IBM Security SiteProtector Integration
- play_arrow Vulnerability Research, News, and Advisories
- play_arrow JSA Vulnerability Manager Engine for OpenVAS Vulnerability Tests
ON THIS PAGE
Common Vulnerability Scoring System (CVSS)
The Common Vulnerability Scoring System (CVSS) is used to rate the severity and risk of computer system security.
In JSA 7.5.0, JSA Vulnerability Manager supports Common Vulnerability Scoring System (CVSS) 2.0, 3.0, and 3.1. Scores and metric values are returned for the highest version available in vulnerability data.
CVSS is an open framework that consists of the following metric groups:
Base
Temporal
Environmental
Base
The base score severity range is 0 - 10 and represents the inherent characteristics of the vulnerability. The base score has the largest bearing on the final CVSS score, and can be further divided into the following subscores:
Impact
The impact subscore represents metrics for confidentiality impact, integrity impact, and the availability impact of a successfully exploited vulnerability.
Exploitability
In CVSS v2, the exploitability subscore represents metrics for Access Vector, Access Complexity, and Authentication. The subscore measures how the vulnerability is accessed, the complexity of the attack, and the number of times an attacker must authenticate to successfully exploit a vulnerability.
In CVSS v3, the exploitability subscore represents metrics for Attack Vector, Attack Complexity, Privileges Required, User Interaction, and Scope. The subscore measures how the vulnerability is accessed, the complexity of the attack, any required privileges, the interaction needed between the attacker and another user, and the impact on resources beyond the vulnerable component.
Temporal
The temporal score represents the characteristics of a vulnerability threat that change over time, and consists of the following metrics:
Exploitability (CVSS v2) or Exploit Code Maturity (CVSS v3)
The availability of techniques or code that can be used to exploit the vulnerability, which changes over time.
Remediation Level
The level of remediation that is available for a vulnerability.
Report Confidence
The level of confidence in the existence of the vulnerability and the credibility of its technical details.
Environmental
The environmental score represents characteristics of the vulnerability that are impacted by the user's environment. Configure the following environmental metrics to highlight the vulnerabilities of important or critical assets by applying higher environmental metrics. Apply the highest scores to the most important assets because losses that are associated with these assets have greater consequences for the organization.
Collateral Damage Potential (CDP) (CVSS v2 only)
The potential for loss of life or physical assets through the damage or theft of this asset, or the economic loss of productivity or revenue.
Target Distribution (TD) (CVSS v2 only)
The proportion of vulnerable systems in your user's environment.
Confidentiality Requirement (CR)
The level of impact to the loss of confidentiality when a vulnerability is exploited on this asset.
Integrity Requirement (IR)
This metric indicates the level of impact to the loss of integrity when a vulnerability is successfully exploited on this asset.
Availability Requirement (AR)
The level of impact to the asset's availability when a vulnerability is successfully exploited on this asset.
