<![CDATA[EOL/Obsolete Operating System: VMware ESXi 6.0 Detected]]>

{"type":"doc","content":[{"type":"paragraph","content":[{"text":"This article explains the reason behind why CVSS Scores are not provided by the Platform when importing Qualys XML files from Qualys VM or Qualys WAS scans","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"style":{"value":"none"}},"macroMetadata":{"macroId":{"value":"5032e6cd-2c06-4f4b-9437-9448b00b0615"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"a619bd8c-f457-4c0e-afa8-63d8ed254eff"}},{"type":"heading","attrs":{"level":1},"content":[{"text":"How CVSS Scores are calculated","type":"text"}]},{"type":"paragraph","content":[{"text":"CVSS Scores are calculated from the corresponding CVSS Vector string provided with most (not all) publicly-disclosed vulnerabilities. In most, if not all cases, publicly-disclosed vulnerabilities are catalogued and assigned a CVE reference or CVE ID.","type":"text"}]},{"type":"paragraph","content":[{"text":"MITRE","type":"text","marks":[{"type":"link","attrs":{"href":"https://cve.mitre.org/index.html"}}]},{"text":", ","type":"text"},{"text":"NVD ","type":"text","marks":[{"type":"link","attrs":{"href":"https://nvd.nist.gov/vuln"}}]},{"text":"and ","type":"text"},{"text":"FIRST ","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.first.org/cvss/"}}]},{"text":"are all good sources of information for understanding the score and categorisation of Common Vulnerabilities and Exposures (CVEs).","type":"text"}]},{"type":"paragraph","content":[{"text":"Consider ","type":"text"},{"text":"this article","type":"text","marks":[{"type":"link","attrs":{"href":"https://nvd.nist.gov/vuln-metrics/cvss"}}]},{"text":" by the NVD, that introduces the concepts for ‘Vulnerability Metrics’:","type":"text"}]},{"type":"paragraph","content":[{"text":"[quote]: ","type":"text"},{"text":"The Common Vulnerability Scoring System (CVSS) is a method used to supply a qualitative measure of severity. CVSS is not a measure of risk. CVSS v2.0 and CVSS v3.x consist of three metric groups: Base, Temporal, and Environmental. The Base metrics result in a numerical score ranging from 0 to 10, which can then be modified by assessing the Temporal and Environmental metrics. ","type":"text","marks":[{"type":"em"}]},{"text":"A CVSS assessment is also represented as a vector string, a compressed textual representation of the values used to derive the score","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"Going into detail around the calculations and metrics used behind a CVSS Score is beyond the scope of this article. However the important thing to note is that a CVSS Score is the numerical measurement (the ‘score') of a vulnerability that is derived from a vulnerability’s CVSS Vector string.","type":"text"}]},{"type":"paragraph","content":[{"text":"Given that a vulnerability's CVSS Score is derived from its associated CVSS Vector string, then it stands to reasons that, in the absence of a CVSS Vector string, the CVSS Score for a vulnerability on its own doesn’t provide sufficient context on how the vulnerability’s CVSS Score was calculated (as there is no CVSS Vector string to work from)","type":"text"}]},{"type":"paragraph","content":[{"text":"As an example, using the CVSS v3.1 scoring system, the CVSS Vector string for a vulnerability would look like this:","type":"text"}]},{"type":"codeBlock","content":[{"text":"AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"NOTE: The CVSS Vector string can include many more ","type":"text"},{"text":"metric:value","type":"text","marks":[{"type":"em"}]},{"text":" pairs if additional scoring beyond Base is available/used. See ","type":"text"},{"text":"here ","type":"text","marks":[{"type":"link","attrs":{"href":"https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator"}}]},{"text":"for more information","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"CVSS Scores in the Platform","type":"text"}]},{"type":"paragraph","content":[{"text":"When importing vulnerability data into the Platform, to assign an appropriate CVSS Score to the resulting issue(s), the imported vulnerabilities must be accompanied with their CVSS Vector string. ","type":"text"}]},{"type":"paragraph","content":[{"text":"During import, the Platform processes the CVSS Vector string for each vulnerability and populates the both the CVSS Vector string ","type":"text"},{"text":"and","type":"text","marks":[{"type":"em"}]},{"text":" the CVSS Score into the resulting issue(s)","type":"text"}]},{"type":"paragraph","content":[{"text":"In short, no CVSS Vector string = no CVSS Score.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Qualys XML lacks CVSS Vector Strings","type":"text"}]},{"type":"paragraph","content":[{"text":"Now to get to the crux of the problem when importing Qualys XML files into the Platform.","type":"text"}]},{"type":"paragraph","content":[{"text":"In short, the XML content on which the Platform relies (when processing vulnerabilities) doesn’t include the CVSS Vector string for an vulnerabilities.","type":"text"}]},{"type":"paragraph","content":[{"text":"The platform team have confirmed this during various tests when building the Qualys XML parser and conclude that the following XML report types lack the necessary CVSS Vector string information:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Qualys VM XML Scan-based Report - the output from exporting a Qualys VM network scan","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Qualys VM XML Host-based Report - the output from exporting a Qualys VM network scan or Cloud-agent based report","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Qualys WAS XML (Scan Report) - the output when exporting a Quals WAS scan report.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"To elaborate; below is an extract from a Qualys VM XML Scan-based Report. This XML extract shows a VMWare related vulnerability along with all available information pertaining to this particular vulnerability:","type":"text"}]},{"type":"codeBlock","content":[{"text":" \n \n <![CDATA[EOL/Obsolete Operating System: VMware ESXi 6.0 Detected]]>\n \n 10.0\n 8.1\n 9.8\n 8.7\n 3.1\n 1\n \n \n \n \n \n \n \nSupport for VMware ESXi 6.0 ended on March 12, 2020\n\n

\nQID Detection Logic (unauthenticated):
\nThis QID reviews OS information from VMware API SOAP request.
\n

]]>\n ]]>\n VMware for information on obtaining the latest version.

]]>\n \n \n ","type":"text"}]},{"type":"paragraph","content":[{"text":"Whilst the vulnerability detail includes multiple CVSS Score details (e.g. the Version, Base score and Temporal score), there is not mention of the CVSS Vector string.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Conclusion","type":"text"}]},{"type":"paragraph","content":[{"text":"Whilst the Platform will provide all information it can with regard to imported vulnerability data, the Platform ultimately relies on the content of the imported data to build all the metadata for an issue.","type":"text"}]},{"type":"paragraph","content":[{"text":"In the case of Qualys XML files, unfortunately the problem lies with Qualys. The current version of their XML output lacks the necessary information to populate CVSS information into the issue once imported into the Platform","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"An Alternate Approach for Qualys VM Integration?","type":"text"}]},{"type":"paragraph","content":[{"text":"There is however another option if integrating the Platform with Qualys VM scan results…..","type":"text"}]},{"type":"paragraph","content":[{"text":"The Qualys VM API does provide additional vulnerability metadata ","type":"text"},{"text":"including","type":"text","marks":[{"type":"em"}]},{"text":" the CVSS Vector, the CVSS Score and the CVE ID.","type":"text"}]},{"type":"paragraph","content":[{"text":"So where possible, the platform team recommend using the Platform’s API-based integration with Qualys VM to retrieve a more comprehensive set of metadata for imported vulnerabilities","type":"text"}]}],"version":1}

Browser not supported