Methodology

CVSS

Exploit Maturity

noyesMicrosoft (MSRC) publishes E, and no hardevidence (KEV, exploit-db, SSVC) showsa higher maturityE taken from MSRCnoyesNo exploit signal: no CISA KEV, noexploit-db, no SSVC (CISA), no NVDreference tagged « Exploit »UnprovenUnproven (CVSS v2.0, v3.x)Unreported (CVSS v4.0)noyesNo CISA KEV, no exploit-db, no SSVC« Active » — but SSVC « PoC » or an NVDreference tagged « Exploit »Proof of conceptProof-of-Concept (CVSS v2.0, v3.x, v4.0)noyesNo EPSS entry for this CVEProof of conceptProof-of-Concept (CVSS v2.0, v3.x, v4.0)noyesEPSS percentile ≥ 90%Active exploitationHigh (CVSS v2.0, v3.x)Attacked (CVSS v4.0)noyesEPSS percentile ≥ 50%FunctionalFunctional (CVSS v2.0, v3.x)Proof-of-Concept (CVSS v4.0)Proof of conceptProof-of-Concept (CVSS v2.0, v3.x, v4.0)no test satisfied

Remediation Level

noyesMicrosoft (MSRC) publishes RL ≠ Unavailable,or publishes Unavailable with no othersource contradicting itRL taken from MSRCnoyesRed Hat tracks the CVE (CSAF VEX) andstates a remediationRL taken from Red HatnoyesAn NVD reference carries the « Patch » tagOfficial fixOfficial Fix (CVSS v2.0, v3.x)noyesThe CPE configurations bound the rangeof vulnerable versionsOfficial fixOfficial Fix (CVSS v2.0, v3.x)noyesA reference carries the tag« Vendor Advisory » or « Mitigation »WorkaroundWorkaround (CVSS v2.0, v3.x)noyesThe description announces a fixOfficial fixOfficial Fix (CVSS v2.0, v3.x)noyesA vendor page untagged by the NVDdocuments a fixOfficial fixOfficial Fix (CVSS v2.0, v3.x)noyesThe CPE dictionary holds a higher versionnever declared vulnerableOfficial fixOfficial Fix (CVSS v2.0, v3.x)UnavailableUnavailable (CVSS v2.0, v3.x)no test satisfied

Report Confidence

noyesMicrosoft (MSRC) publishes RC in itstemporal vector for this CVERC taken from MSRCnoyesRed Hat tracks the CVE (CSAF VEX) andstates a remediationRC taken from Red HatnoyesNVD status « Analyzed » or « Modified »ConfirmedConfirmed (CVSS v2.0, v3.x)noyes≥ 2 organisations published their ownCVSS assessment, incl. NVD or MITREConfirmedConfirmed (CVSS v2.0, v3.x)noyesNVD status « Received »or « Awaiting Analysis »ReasonableUncorroborated (CVSS v2.0)Reasonable (CVSS v3.x)noyes≥ 2 references document the CVEReasonableUncorroborated (CVSS v2.0)Reasonable (CVSS v3.x)noyesA single referenceUnknownUnconfirmed (CVSS v2.0)Unknown (CVSS v3.x)Not definedNot Defined (CVSS v2.0, v3.x)no test satisfied

CVSS version mapping

MetricTree outcomeCVSS 2.0CVSS 3.xCVSS 4.0
EActive exploitationHHA
FunctionalFFP
Proof of conceptPOCPP
UnprovenUUU
RLOfficial fixOFO
WorkaroundWW
UnavailableUU
RCConfirmedCC
ReasonableURR
UnknownUCU
Not definedNDX