Discussion for confidence container about automation-working-group HOT 4 CLOSED

In other words, we need a way to encode the adjective "potential" often used in CVE descriptions. Rather than a "level of confidence", I see it as a binary "based on facts, claims or theory" vs "facts unknown, not enough information or based on assumptions".

from automation-working-group.

Is this not encoded in CVSS 2/3 temporal scores? Or is CVSS out of scope here?

from automation-working-group.

@mydimension you are correct: CVSS does have a metric to indicate confidence:
https://www.first.org/cvss/specification-document#3-3-Report-Confidence-RC

However this does not let us indicate which particular metric values are based on facts and which are assumptions. If something is unknown, CVSS guidelines suggest to assume either the worst case scenario or the most likely scenario.

Take an example where a researcher finds a file with hex encoded ascii text accessible without password on the web interface of a black box product. If that text is an administrative password or a session id, CVSS score can be 10. If it is some insignificant input leftover from a test, CVSS
score can be zero. To start with, the right thing to do here is to give it high score assuming the worst and respond to it with high priority. Here it may be worthwhile to make a note that there are unknowns which if clarified could change the score. While scoring this issue we know for sure AV =N, AC=L, PR=N, UI=N, but there is not enough information to determine S, C, I, A.

from automation-working-group.

Makes sense, and thanks for the explanation. Just wasn't sure if it was a redundant effort.

from automation-working-group.