A look at the time delays in CVSS vulnerability scoring

Abstract

This empirical paper examines the time delays that occur between the publication of Common Vulnerabilities and Exposures (CVEs) in the National Vulnerability Database (NVD) and the Common Vulnerability Scoring System (CVSS) information attached to published CVEs. According to the empirical results based on regularized regression analysis of over eighty thousand archived vulnerabilities, (i) the CVSS content does not statistically influence the time delays, which, however, (ii) are strongly affected by a decreasing annual trend. In addition to these results, the paper contributes to the empirical research tradition of software vulnerabilities by a couple of insights on misuses of statistical methodology.

An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications

“…2 for the intersecting subset of vulnerabilities in Safety DB that have CVEs and the corresponding vulnerabilities in NVD that have CVSS entries. Presumably due to the small delays in NVD's CVSS vulnerability scoring [20], it can be remarked that eight recent CVE-referenced vulnerabilities in Safety DB did not yet have CVSS data in NVD at the time of writing. The subset of vulnerabilities with both CVE and CVSS information indicate only relatively modest severity.…”

A case study on software vulnerability coordination

“…This conjecture applies both to the CVSS framework [5] and to quantitative security assessments in general [41]. However, analogous reasoning does not seem to hold in the context of NVD and the second version of the CVSS standard; the content of the standard does not notably affect the delays for CVSS assignments [88]. In addition to these empirical observations, it is difficult to speculate why some particular CVSS metric would either increase or decrease the coordination and related delays [93].…”

“…Therefore, y i focuses on the internal coordination done by MITRE affiliates, the NVD team, and other actors involved in the coordination. One way to think about this internal coordination is to consider the delay metric as an indirect quantity for measuring how fast work items in a backlog or an inventory are transferred to complete deliveries [62,88]. Due to data limitations, however, it is currently neither possible to observe the internal within-MITRE (or within-NVD) coordination directly nor to explicitly measure the work items in the CVE backlog.…”

“…Another point is that rather analogous problems are often encountered with count data regressions. For instance, the negative binomial distribution is often preferable over the Poisson distribu-tion [88]. Also the gamma distribution is known to characterize related difference-based vulnerability datasets [39].…”

“…where • 1 denotes the L 1 -norm and λ is a non-negative tuning parameter [3]. Although cross-validation and other techniques can be used for selecting the tuning parameter [88], the QR-LASSO regressions are estimated with λ ∈ [1, 2, . .…”