logoalt Hacker News

niccetoday at 5:33 PM2 repliesview on HN

> CVSS scores are literally a Ouija Board that can come out to whatever the user wants them to.

Not really. They are very good at describing the technical impact. Sometimes pre-condition is very rare and that reduces overall likelihood but for those few it applies, the impact still could be catastrophic. Who wants to risk it if whole business could go down?


Replies

akerl_today at 5:39 PM

So if I get a 9.8 that doesn't apply to my usage, what is the CVSS score doing for me?

show 2 replies