Vulnerability Discrimination Using CVSS Framework

In this paper, we study the potentiality of discrimination between vulnerabilities given by CVSS framework. CVSSis an op en framework which assess the intrinsic characteristics of vulnerabilities and gives a severity score for each one. We study the distribution of CVSS metrics (in particular base metrics)in the NVD database. We then focus on the environmental part of CVSS framework, which allows the security level of the user environment to be taken into account. We point out some deficiencies which could be minus points for administrators who want to use this tool in order to discriminate between vulnerabilities, as well as prioritizing those which are the most threatening for their organizations.