logoalt Hacker News

tptacek • today at 7:21 PM • 4 replies • view on HN

"CVSS 10.0" isn't in the headline here and a CVSS of 10 doesn't actually mean anything.

Replies

phoe-krk • today at 7:47 PM

Deeper in the article: https://docs.gitlab.com/releases/patches/patch-release-gitla...

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. (...)

CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Here, CVSS 10.0 means arbitrary remote code execution.

➕ show 1 reply
ivanjermakov • today at 8:03 PM

Because "10 out of 10" is a better headline for the average reader than "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H".

Retr0id • today at 8:16 PM

Sometimes CVSS 10 "oversells" the true severity of a bug but this doesn't seem to be one of those cases.

TZubiri • today at 7:54 PM

>CVSS of 10 doesn't actually mean anything.

Might you perchance be exaggerating?

➕ show 1 reply