Comment by paulez
6 hours ago
This score specifically means that given some specific conditions, anyone can execute code over the network on a vulnerable WordPress setup. Is this not true?
6 hours ago
This score specifically means that given some specific conditions, anyone can execute code over the network on a vulnerable WordPress setup. Is this not true?
I'm not saying that the vulnerability isn't severe or important to people running Wordpress, only that CVSS scores are literally a Ouija Board that can come out to whatever the user wants them to.
Yeah give me a vuln and I can make it anything between a 2 and 8 quite easily. I routinely see 10s that are "Critical 10.0 CVE (but only if you're using X language with X setting changed from default, and the attacker can MiTM your traffic)"
> CVSS scores are literally a Ouija Board that can come out to whatever the user wants them to.
Not really. They are very good at describing the technical impact. Sometimes pre-condition is very rare and that reduces overall likelihood but for those few it applies, the impact still could be catastrophic. Who wants to risk it if whole business could go down?
So if I get a 9.8 that doesn't apply to my usage, what is the CVSS score doing for me?
6 replies →
My assumption is that any Wordpress setup whatsoever allows anyone to execute code remotely.
Indeed, it's a foothold into a network.