Mystical Vulnerabilities: Exploring the Oddities in Cybersecurity

No ratings

Presented at BSides Munich 2024 by

Massimo Morello

In the Information Security world, where many researchers crave to enhance their resume, the aid represented by the concepts of CVE and CVSS is paradoxally and slowly disrupting the vulnerability categorization and management process. Subject to disputed claims by the vendors and inflated severity ratings, the CVE assignment process has become a battleground for recognition, resulting in bogus submissions and unrealistic scores. That's why, for this paper, we have ironically coined the term "Mystical Vulnerabilities": security flaws that are not supposed to be so, but they get filed anyway, exploiting the lack of targeted inspection by MITRE or the NVD. This flawed system compels organizations to allocate resources based on CVE scores, and almost highlight the need for a "scoring system for the scoring system". A shift towards a more filter-oriented culture and more transparent CVE assignment practices is imperative to navigate the complexities of the arising cyber threats. This paper proposes mitigations to this problem, from a cultural change, to additional scoring systems out there for complementing and filtering CVEs, finishing with interesting clean sources and databases.