IIRC the original purpose of CVE identifiers was purely identifiers, like IP addresses - they are assigned in blocks and the assignment of one doesn't say anything about what it points to. The government databases came a bit later.
replyEveryone thinks that system is outdated. I don’t think we have any cybersecurity professionals claiming otherwise.
replyIt is in use just because it already is there and to make something new will be tough.
I think we should drop the score entirely. Just give me details and I should be able to make my risk management based on if it is RCE is it local or just info disclosure etc.
Global scoring is something that feels right but in practice it is totally wrong. Biggest damage happens when management that doesn’t understand any of that wants to have excel sheets green.
Scores are still useful - individual context is always still on the enterprise to determine. But scores could be replaced with a list of capabilities the vuln modifies instead, for nuance. Thing is that there's a HUGE structure of scanning and reporting built on top of the CVE scores. It's load bearing for a lot of stuff.
reply