Hacker News Reader

I have the feeling that for some time now the CVE scores are insane. A while back we have a security issue with a dependency in Java that had a score of 9 I believe. It had a requirement that the attacker had root access.

View on HN

Do you have the CVE number? That's not unreasonable per se, but it could be bogus as you say. A CVSS (base) score is a measure of intrinsic severity of the vulnerability in isolation which is somewhat unintuitive.

A high severity CVE can have zero impact on your system because the vulnerable code path is unreachable, and a pair of low severity CVEs in your system components/libraries can compound and create a critical vulnerability in your system.

I think OP's point is that, if the attacker already has root, they haven't gained any new capabilities from the CVE. They could just do whatever they wanted much more directly. Therefore, the inherent risk seems fairly low.

Yes if that was an accurate description of the supposed vulnerability then I would agree that it's bogus, but we're filling in a lot of blanks here and something tells me there's more to it than that.

Can't find it; we get a lot. I have to correct myself it wasn't root access but machine access. But still a very weird requirement.

*CVSS

Reply on news.ycombinator.com