--- title: "F3: Vulnerabilities, CVE, CWE and CVSS" canonical: https://openvapt.com/academy/f3.html html: https://openvapt.com/academy/f3.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # F3: Vulnerabilities, CVE, CWE and CVSS How vulnerabilities are named, classified and rated, and how to read a severity rating critically. - Level: Foundations - Time: about 20 minutes - Read first: F1, F2 ## You Will Be Able To - Explain the difference between a CVE and a CWE. - Read a CVSS v3.1 vector and explain each metric. - Explain false positives and false negatives and why both matter. ## CVE and CWE A CVE identifier names one specific, publicly known vulnerability in a specific product, for example a flaw in one OpenSSL version. A CWE identifier names a type of weakness, for example CWE-732, incorrect permission assignment for a critical resource. OpenVAPT mostly finds configuration weaknesses, so its checks map to CWE types. Its patch checks detect when published fixes for CVEs are waiting to be installed. ## Reading a CVSS v3.1 Vector A vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes how a vulnerability can be exploited and what it affects. AV is the attack vector (N network, A adjacent, L local, P physical). AC is attack complexity. PR is privileges required. UI is user interaction. S is scope. C, I and A are impact on confidentiality, integrity and availability. Scores map to ratings: Critical 9.0 to 10.0, High 7.0 to 8.9, Medium 4.0 to 6.9, Low 0.1 to 3.9. A base score describes the vulnerability in general; your environment can raise or lower the real risk. ## False Positives and False Negatives A false positive is a reported problem that is not real; it wastes time and erodes trust. A false negative is a real problem that is missed; it creates false confidence. Every automated tool has both. OpenVAPT's tests run each check against a vulnerable and a hardened simulated server. This shows that it fires when it should and stays silent when it should not. That still does not prove the absence of real-world errors. ## In Summary A CVE names one vulnerability in one product. A CWE names the type of weakness. CVSS rates how severe it is, from 0.0 to 10.0. Any finding can be a false positive, so always check the evidence. ## Apply It - [HOST-OS-001 Operating System Past End of Security Support](https://openvapt.com/checks/HOST-OS-001.md) (high) - [HOST-PKG-001 Security Updates Waiting to Be Installed](https://openvapt.com/checks/HOST-PKG-001.md) (high) - [WEB-PHP-004 PHP Version Past End of Security Support](https://openvapt.com/checks/WEB-PHP-004.md) (high) ## Lab 1. `Run: openvapt explain WEB-EXP-002 and decode its CVSS vector metric by metric.` 2. `Open the CWE link on any check page and compare the CWE description with the check's rationale.` 3. `Run the demo against both labs and use openvapt diff to see every finding move to Fixed.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. CWE-732 describes: - A. One specific bug in one product version - B. A type of weakness: incorrect permission assignment for a critical resource - C. A scoring formula - D. A list of exploited vulnerabilities - Answer: B. CWE names weakness types. CVE names specific vulnerabilities in specific products. 2. In a CVSS vector, PR:N means: - A. No privileges are required - B. Network access is required - C. No patch exists - D. No user interaction is required - Answer: A. PR is Privileges Required and N means none. Network access is AV:N and no user interaction is UI:N. 3. A scanner reports no findings. What can you conclude? - A. The system is secure - B. Only that the checks performed did not find their weaknesses - C. Nothing was scanned - D. Every CVE on the system is patched - Answer: B. Absence of findings is not proof of security. Every tool has false negatives and only tests what it was built to test. 4. A CVSS v3.1 base score is 7.5. Which rating does it map to? - A. Low - B. Medium - C. High - D. Critical - Answer: C. In CVSS v3.1, High covers 7.0 to 8.9. Critical starts at 9.0. 5. In a CVSS v3.1 vector, AV:L means: - A. The attacker needs local access to the system - B. The attack works over the network - C. Attack complexity is low - D. Low privileges are required - Answer: A. AV is the attack vector. L means local. Low complexity is AC:L and low privileges is PR:L. 6. Which of these is a false negative? - A. A reported problem that is not real - B. A real weakness the tool missed - C. A finding with Low severity - D. A finding the owner has accepted - Answer: B. A false negative is a real problem that is missed. It creates false confidence. A reported problem that is not real is a false positive. ## Key Terms - CVE: Common Vulnerabilities and Exposures: an identifier for one specific, publicly known vulnerability in a product. - CWE: Common Weakness Enumeration: a catalogue of weakness types, such as incorrect permission assignment. - CVSS: Common Vulnerability Scoring System: a standard way to rate how severe a vulnerability is, from 0.0 to 10.0. - Severity: How serious a finding is, often expressed as Critical, High, Medium or Low. - False Positive: A reported problem that is not real. - False Negative: A real problem that a tool fails to report. - End of Life: The date after which a product no longer receives security fixes from its maintainer. ## References - [FIRST, CVSS v3.1 Specification Document](https://www.first.org/cvss/v3.1/specification-document) - [CVE Program](https://www.cve.org/) - [MITRE CWE](https://cwe.mitre.org/) Offline: `openvapt learn F3`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/f3.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.