Look up CVEs for your own software

Environment

Your own computer and a web browser (nvd.nist.gov).

Before you start

• Read Common Vulnerabilities and Exposures (p.240), Vulnerability Analysis (p.243) and Vulnerability Response and Remediation (p.245).

You will

• Build a software inventory with versions
• Read a CVE entry and CVSS vector
• Prioritise remediation

Steps

1. 1

   List installed software and versions. Windows: Settings → Apps, or winget list. Linux: apt list --installed. Pick five items, e.g. your browser, PDF reader, VPN client, archive tool, and one older app.

2. 2

   For each, search nvd.nist.gov for the product name and version.

3. 3

   Open one CVE and write down its ID, description, CVSS base score, severity and vector string, e.g. AV:N/AC:L/PR:N/UI:R/....

4. 4

   Decode the vector: attack vector, complexity, privileges required, user interaction and impact.

5. 5

   Check whether your installed version is affected and whether a fixed version exists.

6. 6

   Rank your findings by severity and exposure, then update the affected apps. That's remediation.

7. 7

   Record what you did and when, as you would in a vulnerability management report.

Check your understanding

• ?What does AV:N mean, and why does it usually raise priority?
• ?Why isn't the CVSS base score the whole story when you prioritise?
• ?What would you do if no patch were available yet?