Breadcrumbs

CVSS Scores and Exploitability in Mend SCA

CVSS Score Prioritization

  1. MITRE

  2. NVD

  3. EUVD

  4. GitHub Importer

Note:

  • When a score is available from more than one source, the highest-ranked source takes precedence. This logic also applies when scores are added/updated by a higher ranking source later on in the CVE lifecycle.

  • Mend.io may override any of the above based on its own vulnerability analysis.

Source Hierarchy

When a score is available from more than one source, the highest-ranked source takes precedence. This logic applies every time a score is added/updated by a higher ranking source.

Provisional Scores

When a CVE published by one of the supported sources does not include a CVSS score, Mend.io assigns a provisional score based on its own analysis of the vulnerability. Once an official score becomes available, Mend.io replaces the provisional score with that score. The updated score will appear in the UI, API responses, and reports from that point on.

Supported Risk Score Types

Mend.io supports the following types of Risk Scores:

  • CVSS 4.0

  • CVSS 3.x (3.1, 3.0)

  • CVSS 2.0

Although Mend.io processes scores from multiple sources, only the most reliable score of each type is considered during the alert calculation process.

Additional CVSS Sources

In addition to the vendors listed above, the Mend Platform may also retrieve and display CVSS scores issued by sources such as GHSA (GitHub), OSV, and more. The sources will be denoted by a dedicated icon in the UI.

Note: Some CVSS sources do not have an explicit icon and are denoted with a Generic Vendor icon.

Exploitability

Exploitability information is attached to the highest priority result. This means that in case MITRE reports a specific CVSS score with no exploitability, and Mend.io knows that an exploit exists, this information is appended to the CVSS score.

Mend.io’s exploitability detection algorithm works on the principle of the strongest match. Data from various proprietary sources (e.g., CISA KEV) are compared, and the final result is the highest value of all those found. The exploitability value is then added to the CVSS score.

Note: For exploitability, both CISA KEV and EUVD are covered, as well as other proprietary sources. Mend.io selects the highest exploitability value among the detected sources.

Supported Exploitability Values

For CVSS 4.0 

For CVSS 3.X

Attacked (A)

High (H)

Proof-Of-Concept (P)

Functional (F)

Not Defined (X)

Proof-Of-Concept (P)


Not Defined (X)

Unreported and Unproven are not values, because Mend.io cannot definitively state that the exploit code does not exist.

The results are given on a stronger matching basis.

Example: Source 1 shows exploitability as Proof-Of-Concept, while Source 2 shows exploitability as Attacked. The final score is Attacked, since it’s the strongest match.

EPSS Scores

How should I prioritize EPSS scores?

Unlike CVSS, EPSS does not report severity. EPSS provides a likelihood of exploiting a vulnerability, and a percentage of vulnerabilities with equal or lower EPSS score. 

Mend.io recommends prioritizing the vulnerabilities that fall beyond two standard deviations above the mean first (“High Outliers”). Scores that fall within the range from one to two standard deviations above the mean, are classified as “Moderately High”. 

Example: CVE-2024-3094 has an EPSS 0.95359, percentile: 0.993560000, which means it falls into the “High Outliers” interval. 

Q&A

What To Do When EPSS is High, but CVSS Provides No Exploitability Information

A high EPSS score suggests that there are significant chances that the vulnerability will be exploited. However, it does not guarantee exploitation. It simply means that, based on the data and models used to generate the score, there is a higher probability that attackers might target this vulnerability.

The EPSS score should not be confused with exploitability metrics, such as those found in the Common Vulnerability Scoring System (CVSS).

A vulnerability with a high CVSS score but a low EPSS score might be very dangerous if exploited, but the likelihood of it being exploited is low. Conversely, a vulnerability with a high EPSS score but a moderate CVSS score might be more likely to be targeted by attackers, even if the impact is not as severe. 

Should EPSS/Exploitability Information Affect my Remediation Strategy?

In the remediation strategy, it is recommended to prioritize vulnerabilities based on both their exploitability and their potential impact on the codebase. Mend.io recommends an integrated approach, that combines addressing:

  1. Exploited and Reachable Vulnerabilities – these pose an immediate threat and need urgent remediation to prevent further exploitation and mitigate damage. Vulnerabilities that can be accessed and potentially exploited through existing code paths require special attention. 

  2. Exploited Vulnerabilities.

  3. Reachable Vulnerabilities.

  4. High EPSS Scores – even if these vulnerabilities have not been exploited yet, the high probability suggests they could be targeted soon. Proactively addressing these vulnerabilities can prevent potential attacks.