For Teachers · Back to the Module · Print with your browser's Print command.

F3 Worksheet: Vulnerabilities, CVE, CWE and CVSS

Student Worksheet (about 20 minutes, Foundations level)

Name: ______________________ Class: __________ Date: __________

Read first: F1, F2

Learning Objectives

• [ ] Explain the difference between a CVE and a CWE.
• [ ] Read a CVSS v3.1 vector and explain each metric.
• [ ] Explain false positives and false negatives and why both matter.

Key Terms

Write each definition in your own words.

• CVE: ______________________________________________
• CWE: ______________________________________________
• CVSS: ______________________________________________
• Severity: ______________________________________________
• False Positive: ______________________________________________
• False Negative: ______________________________________________
• End of Life: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt explain WEB-EXP-002 and decode its CVSS vector metric by metric.
2. Open the CWE link on any check page and compare the CWE description with the check's rationale.
3. Run the demo against both labs and use openvapt diff to see every finding move to Fixed.

Self-Check Questions

1. CWE-732 describes:

• [ ] a) One specific bug in one product version
• [ ] b) A type of weakness: incorrect permission assignment for a critical resource
• [ ] c) A scoring formula
• [ ] d) A list of exploited vulnerabilities

1. In a CVSS vector, PR:N means:

• [ ] a) No privileges are required
• [ ] b) Network access is required
• [ ] c) No patch exists
• [ ] d) No user interaction is required

1. A scanner reports no findings. What can you conclude?

• [ ] a) The system is secure
• [ ] b) Only that the checks performed did not find their weaknesses
• [ ] c) Nothing was scanned
• [ ] d) Every CVE on the system is patched

1. A CVSS v3.1 base score is 7.5. Which rating does it map to?

• [ ] a) Low
• [ ] b) Medium
• [ ] c) High
• [ ] d) Critical

1. In a CVSS v3.1 vector, AV:L means:

• [ ] a) The attacker needs local access to the system
• [ ] b) The attack works over the network
• [ ] c) Attack complexity is low
• [ ] d) Low privileges are required

1. Which of these is a false negative?

• [ ] a) A reported problem that is not real
• [ ] b) A real weakness the tool missed
• [ ] c) A finding with Low severity
• [ ] d) A finding the owner has accepted

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• FIRST, CVSS v3.1 Specification Document: https://www.first.org/cvss/v3.1/specification-document
• CVE Program: https://www.cve.org/
• MITRE CWE: https://cwe.mitre.org/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.