Vulnerability Scanning and CVSS Scoring

What Is Vulnerability Scanning?

A vulnerability scan is an automated process that probes a system, network, or application and compares what it finds against a database of known weaknesses. The scanner checks software versions, configurations, open ports, and missing patches, then produces a report that ranks findings by severity. Unlike a penetration test, a vulnerability scan does not exploit the weaknesses it finds — it only identifies and reports them.

Credentialed vs. non-credentialed scans. A non-credentialed scan sees only what an unauthenticated attacker sees from the network. A credentialed scan logs in to the target using a service account and inspects the system from the inside — installed software, registry keys, local users, patch levels — producing far fewer false negatives. For internal vulnerability management programs, credentialed scans are the standard because they give a more complete picture.

OpenVAS / Greenbone Community Edition

OpenVAS (Open Vulnerability Assessment System), distributed as the Greenbone Community Edition (GCE), is a widely used open-source vulnerability scanner. It maintains a feed of Network Vulnerability Tests (NVTs) synchronized from Greenbone's servers. You configure a scan target (one or more IP addresses), a scan config (the set of tests to run), optionally attach credentials so the scanner can log in, and then create and launch a task. When the task finishes you export a report in PDF, XML, or CSV format.

Lab safety rule — critical: Before launching any scan, confirm that the target IP range belongs only to the isolated lab subnet. Scanning outside the designated subnet — especially against production systems or systems you do not own — is unauthorized under the Computer Fraud and Abuse Act and similar laws and will result in immediate removal from the lab exercise. Your instructor will verify scan scope before you press Start.

Understanding CVSS v3.1

The Common Vulnerability Scoring System (CVSS), maintained by FIRST (Forum of Incident Response and Security Teams), gives each vulnerability a numerical score from 0.0 to 10.0 and a matching severity label:

| Score range | Label |

|---|---|

| 0.0 | None |

| 0.1 – 3.9 | Low |

| 4.0 – 6.9 | Medium |

| 7.0 – 8.9 | High |

| 9.0 – 10.0 | Critical |

The Base Score captures the intrinsic characteristics of the vulnerability, independent of environment or time. It is calculated from two metric groups:

• Exploitability metrics — Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), User Interaction (UI)
• Impact metrics — Confidentiality Impact (C), Integrity Impact (I), Availability Impact (A), plus the Scope (S) value that indicates whether a successful exploit can affect resources beyond the vulnerable component

Each metric has a small set of defined values, each with a numeric weight. You pick the correct value for each metric based on how the vulnerability works, then the formula combines them into the Base Score. FIRST publishes a free calculator at first.org/cvss/calculator/3.1 that performs the arithmetic for you once you select the metric values.

Reading the vector string. Every CVSS v3.1 Base Score is accompanied by a vector string that encodes all metric choices in a compact, human-readable form. Example:

`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

This reads: Attack Vector = Network, Attack Complexity = Low, Privileges Required = None, User Interaction = None, Scope = Unchanged, Confidentiality = High, Integrity = High, Availability = High — which calculates to a Base Score of 9.8 (Critical).

NVD and CVE Entries

The National Vulnerability Database (NVD) at nvd.nist.gov is the US government repository for CVE (Common Vulnerabilities and Exposures) records. Each CVE entry includes a description, affected products, references, and the CVSS score. When your scanner flags a finding, you can look up the CVE number in NVD to read the full description and verify the score. OpenVAS links findings to CVE IDs in its report, making this cross-reference straightforward.

Prioritizing Findings

After a scan you will typically have dozens or hundreds of findings. Prioritization is essential:

1. Sort by CVSS Base Score descending. Address Critical and High findings first.

2. Check exploitability. A Critical finding on a system with no network exposure may rank lower in practice than a High finding on an internet-facing host.

3. Consider asset value. A vulnerability on a database server storing sensitive data deserves faster remediation than the same vulnerability on a test workstation.

4. Look for public exploits. If the NVD entry or threat intelligence feeds show a known exploit in the wild, escalate urgency.

CVSS alone does not tell you which vulnerability to fix first — it tells you how severe the flaw is in isolation. A mature vulnerability management program layers CVSS with asset criticality and threat intelligence to produce a prioritized remediation list.

Completing This Lab Safely

Metasploitable2 is a deliberately vulnerable Linux VM used only for authorized training. Keep it on the isolated host-only or internal network adapter — never bridge it to the internet or the campus LAN. Take a snapshot before scanning so you can restore the VM to a clean state. Document every step using the setup checklist; your instructor will sign off on scope before you launch.