<story><title>NVD Damage Continued</title><url>https://daniel.haxx.se/blog/2023/06/12/nvd-damage-continued/</url></story><parent_chain><item><author>eugenekolo</author><text>It&amp;#x27;s a social and economic problem.&lt;p&gt;The NVD and CVE teams are very low staffed, with people who get a large amount of reports every day. There is no way they can process each report as thoroughly as people want them to while reporting the security issues as fast as possible. I can understand the frustration, but there should be some consideration for these facts.&lt;p&gt;The social issue continues in that people want some quick and easy to understand number, because they and their company also cannot process in a short time if these security vulns are substantial or not.&lt;p&gt;Then there&amp;#x27;s gaming of the system where products with bugs do not want to be exposed as insecure, so they will try to lower the scores assigned to them. Then there&amp;#x27;s pentesters who want to get high scoring bugs for bounties and clout, and  they will try to raise the scores...&lt;p&gt;All this ends up where the scores mean very little, but it&amp;#x27;s the best we have. I&amp;#x27;ve seen vulns with a 9+ that are clearly not exploitable, and ones that are 6-7 which are powerful easily exploitable primitives.</text></item></parent_chain><comment><author>DannyBee</author><text>&amp;quot;The social issue continues in that people want some quick and easy to understand number, because they and their company also cannot process in a short time if these security vulns are substantial or not.&lt;p&gt;&amp;quot;&lt;p&gt;Uh, none of this explains why they re-score the vulnerabilities themselves, ignoring the vendor scores and deciding they know best, when they seem to know ... nothing.&lt;p&gt;Which if you read through the links, you&amp;#x27;ll see is one of the main complaints, and something they document here:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nvd.nist.gov&amp;#x2F;general&amp;#x2F;FAQ-Sections&amp;#x2F;CVE-FAQs#faqLink9&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;nvd.nist.gov&amp;#x2F;general&amp;#x2F;FAQ-Sections&amp;#x2F;CVE-FAQs#faqLink9&lt;/a&gt;&lt;p&gt;Their take is basically &amp;quot;we get to do this and if it&amp;#x27;s wrong it&amp;#x27;s your problem to get us to correct us&amp;quot;.&lt;p&gt;That doesn&amp;#x27;t make any sense.&lt;p&gt;As my child&amp;#x27;s kindergarten teacher once asked a student: &amp;quot;Do you think if everyone decided to do that, it would turn out okay?&amp;quot;&lt;p&gt;NVD and CVE teams will simply never have the expertise or time or information necessary to actually re-score these things correctly.  You&amp;#x27;ll also note that despite claiming they score things based on publicly available information, and that othres must do the same, they cite absolutely no sources to Daniel to defend their scoring.&lt;p&gt;They light themselves on fire, generate smoke and noise that others have to deal with, and then complain that it&amp;#x27;s the job of others to put it out.</text></comment>
<story><title>NVD Damage Continued</title><url>https://daniel.haxx.se/blog/2023/06/12/nvd-damage-continued/</url></story><parent_chain><item><author>eugenekolo</author><text>It&amp;#x27;s a social and economic problem.&lt;p&gt;The NVD and CVE teams are very low staffed, with people who get a large amount of reports every day. There is no way they can process each report as thoroughly as people want them to while reporting the security issues as fast as possible. I can understand the frustration, but there should be some consideration for these facts.&lt;p&gt;The social issue continues in that people want some quick and easy to understand number, because they and their company also cannot process in a short time if these security vulns are substantial or not.&lt;p&gt;Then there&amp;#x27;s gaming of the system where products with bugs do not want to be exposed as insecure, so they will try to lower the scores assigned to them. Then there&amp;#x27;s pentesters who want to get high scoring bugs for bounties and clout, and  they will try to raise the scores...&lt;p&gt;All this ends up where the scores mean very little, but it&amp;#x27;s the best we have. I&amp;#x27;ve seen vulns with a 9+ that are clearly not exploitable, and ones that are 6-7 which are powerful easily exploitable primitives.</text></item></parent_chain><comment><author>brohee</author><text>They could have a tiered system where at least things that have &lt;i&gt;deployments in the billions&lt;/i&gt; get a special treatment. Holidays can be cancelled, releases rescheduled over a bad enough vulnerability in a sufficiently common software. Miscoring a vulnerability makes a thing that is supposed to be good, by promoting a more secure ecosystem, end up being actually bad, wasting resources that could have been spent on solving actual issue. Not even speaking about the lowered trust in NVD...</text></comment>