Vulnerability prioritization
Rank eight findings with CVSS, EPSS, known-exploited status, exposure, and asset value, and fill a three-slot patch window with the right fixes.
Goal
The scanner report lists eight open findings. The change board has approved one window this week with room for three fixes, and the current process sorts by CVSS alone.
Turn criteria on, put them in order, and watch the ranking change. The goal is a ranking that puts the three flaws attackers can reach and are most likely to use at the top. Scores are illustrative, not real CVE records.
- 1CVSS base score
- offEPSS probability
- offKnown exploited
- offExposure
- offAsset criticality
| # | Finding | CVSS base score | EPSS probability | Known exploited | Exposure | Asset criticality |
|---|---|---|---|---|---|---|
| 1 | Hypervisor guest-to-host escape esx-mgmt cluster | 10.0 | 0.02 | no | isolated | critical |
| 2 | VPN gateway authentication bypass vpn-gw-1 | 9.8 | 0.94 | yes | internet | critical |
| 3 | Database server remote code execution erp-db | 9.1 | 0.05 | no | internal | critical |
| 4 | Logging library remote code execution offline batch host | 9.0 | 0.97 | yes | isolated | medium |
| 5 | File transfer server SQL injection mft-01 | 8.8 | 0.71 | yes | internet | high |
| 6 | Webmail server request forgery to internal services mail-01 | 8.1 | 0.62 | no | internet | high |
| 7 | Print spooler local privilege escalation 1,400 workstations | 7.8 | 0.88 | yes | internal | medium |
| 8 | CMS plugin stored cross-site scripting marketing site | 6.1 | 0.35 | no | internet | low |
Steps
01This week’s change window fits three fixes. Arrange and enable the criteria so the top three are the VPN gateway, the file transfer server, and the webmail server, in that order.
Do this in the workbench above. This step completes itself when the condition is met.
02Sorted by CVSS alone, which finding is first? Give its asset.
03What does an EPSS value of 0.94 mean?
04The logging library flaw is known exploited with an EPSS of 0.97. Why is it not in this week’s three?
05The print spooler flaw is known exploited on 1,400 workstations but needs local access. What is a sensible plan?