Vulnerabilities, CVE, CWE and CVSS

CVE and CWE

A CVE identifier names one specific, publicly known vulnerability in a specific product, for example a flaw in one OpenSSL version. A CWE identifier names a type of weakness, for example CWE-732, incorrect permission assignment for a critical resource.

OpenVAPT mostly finds configuration weaknesses, so its checks map to CWE types. Its patch checks detect when published fixes for CVEs are waiting to be installed.

Reading a CVSS v3.1 Vector

A vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes how a vulnerability can be exploited and what it affects. AV is the attack vector (N network, A adjacent, L local, P physical). AC is attack complexity. PR is privileges required. UI is user interaction. S is scope. C, I and A are impact on confidentiality, integrity and availability.

Scores map to ratings: Critical 9.0 to 10.0, High 7.0 to 8.9, Medium 4.0 to 6.9, Low 0.1 to 3.9. A base score describes the vulnerability in general; your environment can raise or lower the real risk.

False Positives and False Negatives

A false positive is a reported problem that is not real; it wastes time and erodes trust. A false negative is a real problem that is missed; it creates false confidence. Every automated tool has both.

OpenVAPT's tests run each check against a vulnerable and a hardened simulated server. This shows that it fires when it should and stays silent when it should not. That still does not prove the absence of real-world errors.

In Summary

A CVE names one vulnerability in one product. A CWE names the type of weakness. CVSS rates how severe it is, from 0.0 to 10.0. Any finding can be a false positive, so always check the evidence.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt explain WEB-EXP-002 and decode its CVSS vector metric by metric.
2. Open the CWE link on any check page and compare the CWE description with the check's rationale.
3. Run the demo against both labs and use openvapt diff to see every finding move to Fixed.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• FIRST, CVSS v3.1 Specification Document
• CVE Program
• MITRE CWE

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). F3: Vulnerabilities, CVE, CWE and CVSS (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/f3.html

@misc{openvapt_f3,
  author       = {{OpenVAPT}},
  title        = {{F3: Vulnerabilities, CVE, CWE and CVSS}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/f3.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}