Comment by ozim
8 hours ago
Everyone thinks that system is outdated. I don’t think we have any cybersecurity professionals claiming otherwise.
It is in use just because it already is there and to make something new will be tough.
I think we should drop the score entirely. Just give me details and I should be able to make my risk management based on if it is RCE is it local or just info disclosure etc.
Global scoring is something that feels right but in practice it is totally wrong. Biggest damage happens when management that doesn’t understand any of that wants to have excel sheets green.
Scores are still useful - individual context is always still on the enterprise to determine. But scores could be replaced with a list of capabilities the vuln modifies instead, for nuance. Thing is that there's a HUGE structure of scanning and reporting built on top of the CVE scores. It's load bearing for a lot of stuff.