Common Vulnerability Scoring System

By Peter Mell, Karen Scarfone, S. Romanosky. IEEE Security and Privacy, 2006

825 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Optimal Network Security Hardening Using Attack Graph Games (2015, methodology): “…that the information about the costs and success probabilities for different actions can be estimated using the Common Vulnerability Scoring System [Mell et al., 2006] values available in the National Vulnerability Database [Bacic et al., 2006], historical data, red team exercises, or be directly…”
An Attack Graph-Based Probabilistic Security Metric (2008, methodology): “This value thus only depends on each individual vulnerability, which is similar to many existing metrics, such as the CVSS [13].”
A Survey on Advanced Persistent Threats: Techniques, Solutions, Challenges, and Research Opportunities (2019, neutral): “…are usually exposed and can be obtained from well-known vulnerability databases such as Common Vulnerabilities and Exposures List (CVE), and NIST National Vulnerability Database (NVD) [10] which publicly disclosed vulnerabilities where each vulnerability is identiﬁed using an unique CVE-ID.”
DAG-based attack and defense modeling: Don't miss the forest for the attack trees (2013, background): “The paper proposes to link the mean TTC to the CVSS metric values [191] of specific vulnerabilities, which makes the employment of easily available inputs possible.”