CVSS V3 Attributes Based Filters
Attack vectors, attack complexities, and privilege required to influence the CVSS V3 score can be used in inventory filters. The following operations are supported in the filter:
-
=: Returns hosts with packages affected by vulnerabilities matching the filter.
-
≠: Returns hosts with packages not affected by vulnerabilities matching the filter.
Attack Vector
This metric reflects the context by which vulnerability exploitation is possible. The farther an attacker can get from the vulnerable component, the higher the base score. The table below lists different attack vectors with their access requirements:
|
Value |
Type of access |
|---|---|
|
LOCAL |
Local (keyboard, console) or remote (SSH). |
|
PHYSICAL |
Physical access is needed. |
|
ADJACENT_NETWORK |
Broadcast or collision. |
|
NETWORK |
Remotely exploitable. |
Attack Complexity
This metric describes the conditions that must exist in order to exploit the vulnerability. The base score is greatest for least complex attacks. The different types of access complexities are as follows:
|
Value |
Description |
|---|---|
|
HIGH |
Significant effort needed in setting up and executing the attack. |
|
LOW |
Specialized access conditions do not exist. |
Privileges Required
This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. The base score is highest when privileges aren’t needed to carry out an attack. The different values of privilege required are as follows:
|
Value |
Privileges required |
|---|---|
|
HIGH |
Privileges providing significant control over the vulnerable component. |
|
LOW |
Low privileges that grant access to non-sensitive resources. |
|
NONE |
Privileges aren’t needed to carry out an attack. |