Reading a vulnerability report

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which is a correctly formatted CVE identifier?

A CVE-VERY-BAD-1

B CVE-2021-44228

2. A report lists 'Affected versions: 2.0 to 2.14.1'. You run version 2.10. What should you conclude?

A Your version is affected and you should look for a fix

B You are safe because 2.10 is a small number

3. A vulnerability has a severity score of 9.8 out of 10. How should you treat it?

A Critical: fix it as a high priority

B Low risk: it can wait until next year

4. Which part of a vulnerability report tells you how to fix the problem?

A The CVE identifier

B The patch or workaround link

5. No patch is available yet, but the report suggests turning off a risky feature. What is this called?

A A workaround

B A patch

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1CVE-2021-44228		AThe version number was not compared properly. Version 2.20 is outside the affected range, so this app is not listed as vulnerable.
2CVSS score: 9.8 (Critical)		BAffected versions: 2.0 to 2.14.1
3The affected versions line tells you whether the software you run is vulnerable		CFix: update to version 2.15.0
4The fix section links to a patch or a workaround that removes or reduces the risk		DA score of 2.1 is low severity. High scores near 10 mean the most urgent and dangerous flaws.
5My app is version 2.20, and the report says versions 2.0 to 2.14 are affected, so I must be at risk.		EThe severity score that rates how dangerous the vulnerability is, on a scale from 0 to 10
6The severity score is 2.1 out of 10, so this is the most urgent flaw and I should fix it first.		FThe unique CVE identifier that names one specific vulnerability so everyone can look up the same report

Definitions

CVE

Fill in the Blanks

Complete each line of code by filling in the missing parts.

ID: ___-2024-31337

Severity: 9.8 (________)

________ versions: ShopApp 2.0 to 2.4

Fix: upgrade to 2.5 or apply the _____

Severity score: 9.8 out of __

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Product: Apache Log4j

B ID: CVE-44228-2021

C Affected: 2.0 to 2.14.1

D Fix: upgrade to 2.15.0

Question 2

A ID: CVE-2014-0160

B Software: OpenSSL 1.0.1

C Severity: 75 (High)

D Fix: upgrade to 1.0.1g

Question 3

A ID: CVE-2017-0144

B Severity: 9.8 (Low)

C Affected: Windows SMBv1

D Fix: install patch MS17-010

Question 4

A CVE-2023-1234

B Affected: ShopApp 3.1 to 3.4

C Fixed in: 3.2

D Advice: update to 3.5 or later

Question 5

A CVE-2022-5555

B Affected: ChatBox 1.0 to 1.3

C Flaw: unsafe file upload

D Workaround: allow all uploads

Answer Key

Reading a vulnerability report

Section A: Quick Questions

B — CVE-2021-44228

A — Your version is affected and you should look for a fix

A — Critical: fix it as a high priority

B — The patch or workaround link

A — A workaround

Section B: Match the Pairs

CVE-2021-44228 → The unique CVE identifier that names one specific vulnerability so everyone can look up the same report

CVSS score: 9.8 (Critical) → The severity score that rates how dangerous the vulnerability is, on a scale from 0 to 10

The affected versions line tells you whether the software you run is vulnerable → Affected versions: 2.0 to 2.14.1

The fix section links to a patch or a workaround that removes or reduces the risk → Fix: update to version 2.15.0

My app is version 2.20, and the report says versions 2.0 to 2.14 are affected, so I must be at risk. → The version number was not compared properly. Version 2.20 is outside the affected range, so this app is not listed as vulnerable.

The severity score is 2.1 out of 10, so this is the most urgent flaw and I should fix it first. → A score of 2.1 is low severity. High scores near 10 mean the most urgent and dangerous flaws.

Section C: Definitions

CVE — A public vulnerability report with a unique ID that names the affected software and versions, explains how the flaw is exploited, gives a severity score and links to a fix.

Section D: Fill in the Blanks

ID: CVE-2024-31337

Severity: 9.8 (Critical)

Affected versions: ShopApp 2.0 to 2.4

Fix: upgrade to 2.5 or apply the patch

Severity score: 9.8 out of 10

Section E: Spot the Error

B — A CVE identifier is written CVE-YEAR-NUMBER. The year comes first, so the ID should be CVE-2021-44228.

C — Severity scores run from 0 to 10. A score of 75 is impossible, so it should be 7.5.

B — A score of 9.8 is in the 9.0-10.0 band, which is Critical. It should not be labelled Low.

C — The fix must be a version newer than the affected range (3.1 to 3.4). Version 3.2 is still vulnerable, so it should say 3.5.

D — A workaround reduces the risk until a patch is installed. The flaw is in file upload, so the workaround should disable uploads, not allow them.