Security Concepts · Topic 2 of 7
Vulnerabilities, Exploits, CVE and CVSS
Understand software vulnerabilities and exploits, such as injection, XSS, CSRF, buffer overflow and path traversal, and how CVE and CVSS drive patching.
- 4 min
- A vulnerability is the weakness. An exploit is what uses it.
- SQL injection mixes attacker input into a query. Parameterised queries defend against it.
- XSS runs script in the victim browser. CSRF forces an unwanted request from a logged in user.
What it is
A vulnerability is a weakness, and an exploit is the technique or code that takes advantage of it.
The weakness may be a coding error, a poor default or a missing control. An exploit turns that weakness into access or damage. Finding and ranking vulnerabilities is what lets a team fix the most dangerous ones first.
How it works
Most exam examples are input handling failures, weak secrets or missing cryptography.
Common vulnerability types
| Vulnerability | What goes wrong |
|---|---|
| Software bug | A coding flaw that the attacker can trigger deliberately |
| Weak or hardcoded password | Guessable secrets, or credentials embedded in code or firmware |
| Buffer overflow | Input larger than the memory space overwrites nearby memory, which can run attacker code |
| Path traversal | Input such as ../ escapes the intended folder and reads other files |
| SQL injection | Input is interpreted as part of a database query |
| Cross-site scripting (XSS) | A site returns attacker script that runs in the victim browser |
| Cross-site request forgery (CSRF) | A logged in user browser is tricked into sending an unwanted request |
| Missing encryption ciphers | Data is sent in clear text, or protected with weak or outdated algorithms |
The root cause of the injection family is the same. The application trusts input and mixes data with commands.
Defences for each family
Input validation and output encoding stop most injection and XSS flaws. Parameterised queries separate the SQL command from the data, which defeats SQL injection.
Anti-CSRF tokens prove that a request came from the real site form. Bounds checking and memory safe languages reduce buffer overflows. Secrets belong in a vault, not in source code, and default passwords must be changed.
OWASP Top Ten
The OWASP Top Ten is a regularly updated awareness list of the most critical web application risks. It includes broken access control, cryptographic failures, injection, insecure design and security misconfiguration. Know that it exists, that it covers web applications, and that injection and broken access control are on it.
Identification: CVE
A CVE (Common Vulnerabilities and Exposures) entry gives a publicly known vulnerability a unique identifier. The format is CVE-YEAR-NUMBER, for example CVE-2021-44228.
A shared identifier lets vendors, scanners and advisories talk about the same flaw. A CVE tells you which flaw it is, but not how urgent it is.
Prioritization: CVSS
CVSS (Common Vulnerability Scoring System) rates severity from 0.0 to 10.0. The base score reflects the flaw itself, such as how it is reached, how complex it is and the impact on confidentiality, integrity and availability.
| Score range | Rating |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
The base score is not the whole answer. Temporal and environmental metrics adjust it for exploit availability and for how important the affected asset is in your network.
Practical prioritization
A good programme combines several facts. A medium score on an internet facing server with a public exploit can outrank a high score on an isolated lab host.
- How severe is the CVSS score?
- Is the system reachable from the internet?
- Is an exploit known to be in use?
- How valuable is the asset or data?
What to remember for the exam
Six facts cover most questions on this topic.
- A vulnerability is the weakness. An exploit is what uses it.
- SQL injection mixes attacker input into a query. Parameterised queries defend against it.
- XSS runs script in the victim browser. CSRF forces an unwanted request from a logged in user.
- Buffer overflow overwrites memory, and path traversal uses
../to escape a folder. - A CVE is an identifier. CVSS is a 0 to 10 severity score, and 9.0 and above is critical.
- Prioritize with CVSS plus exposure, exploit activity and asset value.
If a question asks which control stops SQL injection, think input validation and parameterised queries, not a firewall rule.
Common mistakes
These four mistakes appear often.
Mixing up XSS and CSRF. XSS delivers script into the browser, while CSRF abuses the existing logged in session to send a request.
Treating a CVE as a score. A CVE is only an identifier, and the CVSS score is a separate rating.
Patching strictly by score. A lower scored flaw on an exposed system with a known exploit may need action first.
Leaving hardcoded or default credentials. Attackers search for these first, so remove them before deployment.
A scanner finding is not proof of risk and a clean scan is not proof of safety. Validate findings in the context of your own network.
Check yourself
Work through these three questions.
What is the difference between a CVE and a CVSS score?
A CVE is a unique identifier for a known vulnerability, while CVSS is a 0 to 10 severity rating of it.
Which control most directly defeats SQL injection?
Input validation and parameterised queries, which keep attacker input separate from the database command.
Why might a medium CVSS flaw be patched before a high one?
Exposure, a known exploit and asset value also matter, so an exposed, actively exploited system can be more urgent.
Topic 2 of 7 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.