A flaw with a name tag
In December 2021 a flaw in a common piece of software was found. Companies around the world had to check their systems that weekend.
How did everyone talk about the same flaw? It had an ID number. And how did they know it was serious? It had a score of 10 out of 10.
Key words
| Word | What it means |
|---|---|
| Vulnerability | a weak point that an attacker could use |
| CVE | Common Vulnerabilities and Exposures: a public list of known weak points, each with an ID |
| CVSS | Common Vulnerability Scoring System: a score from 0 to 10 for how serious a weak point is |
| Vendor | the company that makes or sells a product |
| Mitigation | an action that makes the harm smaller |
| Exploit | to use a weak point to get in or do harm |
| Affected system | a system that has the weak point |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can read a CVE entry, turn its CVSS score into a band and say what to do next.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
A CVE is a public flaw ID
Each known flaw gets one ID, such as CVE-2021-44228. The ID is the letters CVE, the year, and a number of four or more digits.
Flaws are published by vendors and by security testers who find them. Everyone can then use the same ID. A scanner report that shows a CVE ID lets you look the flaw up.
A real entry, in short
| Part | Detail |
|---|---|
| ID | CVE-2021-44228, often called Log4Shell |
| Affected system | Apache Log4j 2, a logging tool used inside many programs |
| CVSS score | 10.0, which is critical |
| Mitigation | Update Log4j to a fixed version |
The cells students fill in are left blank in this preview.
Invented IDs
Note
Later in this lesson we use IDs such as CVE-2099-0001. They are examples. They are not real entries.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.