Lion Cipher Lab
Recompute CVSS v3.1 scores in a findings list and catch bad numbers
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
CVSS (the Common Vulnerability Scoring System) is how most security findings get a severity number. Each finding carries a vector string — a compact code like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describing how the vulnerability is exploited and what it affects — and a base score from 0.0 to 10.0 computed from that vector, which maps to a band of None/Low/Medium/High/Critical. Those numbers drive what gets fixed first, so a wrong one quietly misdirects remediation effort. And wrong numbers are common: scores get transcribed by hand and typo'd, severity labels get pasted from the wrong…
What you'll learn
- parsing a CVSS:3.1 base vector
- implementing the v3.1 base-score equation from the FIRST spec
- deriving the severity band from a score
- catching transcription, severity-band and scope-change errors
- knowing what recomputation cannot catch
- why base score is only the start of prioritization
Steps in this lab
- Why recompute a score you were handed
- The findings list
- Implement the v3.1 base equation
- Run it: five bad numbers out of six
- What recomputation can and cannot catch