How do you set risk score for pentest vulnerabilities which do no have CVE assigned?
Source Reddit Cybersecurity
Discussion
This content discusses the challenge of assigning risk scores to penetration testing findings that do not have associated CVE identifiers. It highlights the difficulty in applying frameworks like CISA KEV and EPSS, which focus on CVE-based vulnerabilities, to findings such as misconfigurations. The author seeks an objective, justifiable method for scoring such findings, noting that existing methodologies like the OWASP Risk Rating Methodology may lack accuracy for all cases.
r/cybersecurity (opens in a new tab)u/estrangedpulse0 points0 comments
We are working on a system to be able to assign risk scores for various findings during the penetration tests. The idea is to use CVSS, CISA KEV and EPSS. The challenge I came across is that KEV and EPSS are mostly designed to get insight into likelihood of exploitation of CVEs, however in practice very often a security finding does not have CVE assigned.
Often its a misconfiguration of sorts, so how do you normally handle those types of findings? Do you still assign CVSS nevertheless and just ignore KEV/EPSS, and set the that manually? I would prefer a system where there is some sort of objective formula or system which allows different pentesters to select and define likelihood and impact in a way which can be justified.
On the other hand I don't want to use something like OWASP Risk Rating Methodology for all of the findings, since it lacks accuracy in my experience.