CVE, CVSS and severity levels

Security (DevSecOps) · Vulnerability scanning with Trivy in the pipeline · Lesson 1 of 5

A CVE is a public identifier for a vulnerability and CVSS scores its severity from 0 to 10; prioritise by severity, likelihood of exploitation and whether a fix exists.

Core terms

Term	Meaning
Vulnerability	A weakness in software that can be abused
CVE	A public identifier such as `CVE-2024-3094`, assigned by CNAs
CVSS	A 0.0–10.0 scoring system based on how it is exploited and its impact
Severity	Score bands: Low, Medium, High, Critical
Exploit	Code or a technique that takes advantage of the vulnerability
Advisory	A vendor or distro notice, including the fixed version

Some databases: NVD (NIST), the GitHub Advisory Database, OSV, and the advisories of Debian, Ubuntu, Red Hat and Alpine. A distro may rate severity differently from NVD because it builds packages differently.

Reading CVSS

Score	Severity
0.1–3.9	Low
4.0–6.9	Medium
7.0–8.9	High
9.0–10.0	Critical

A vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H says: attack over the network (AV:N), easy (AC:L), no privileges needed (PR:N), no user interaction (UI:N), high impact on confidentiality, integrity and availability. CVSS 4.0 was released in 2023, but 3.1 is still common.

Prioritising

A high CVSS score is not always the most urgent item. Consider:

flowchart TD
  F["CVE found"] --> K{"In CISA KEV<br/>or high EPSS?"}
  K -- "Yes" --> U["Fix immediately"]
  K -- "No" --> S{"Critical / High<br/>with a fix?"}
  S -- "Yes" --> P["Upgrade this sprint"]
  S -- "No" --> R{"Does the code really use<br/>the faulty part?"}
  R -- "Yes" --> M["Mitigate, watch for a fix"]
  R -- "No" --> A["Record it, accept the risk for a limited time"]

CISA KEV: the catalogue of CVEs known to be exploited in the wild.
EPSS: the probability a CVE will be exploited in the next 30 days.
Fixed version: whether a fix exists; if so, upgrading is usually the cheapest path.
Reachability: a vulnerable package that is never called carries lower risk.

Traps

Looking only at the count of CVEs; a small image with few CVEs usually beats chasing single patches.
Treating "unfixed" CVEs as a reason to ignore them forever.
Blocking pipelines on every Low finding, so the team switches the scanner off.