Findings Properties

The context where vulnerability exploitation is possible, such as Network or Local.

The permission level attackers require to exploit the vulnerability. Options are High, Low, or None. For example, None means attackers need no permissions in your environment and can exploit the vulnerability while unauthorized.

The level of user involvement required for an attacker to exploit the vulnerability.

The impact on the availability of the vulnerable system when successfully exploited.

The impact on the confidentiality of the vulnerable system when successfully exploited.

The impact on the integrity of the vulnerable system when successfully exploited.

The impact on the availability of systems that can be impacted after the vulnerable system is exploited.

The impact on the confidentiality of systems that can be impacted after the vulnerable system is exploited.

The impact on the integrity of systems that can be impacted after the vulnerable system is exploited.

The CVSS v4.0 threat score (CVSS-T), which adjusts the base score by incorporating real-world threat intelligence, such as the presence of active exploitation, exploit code availability, or observed malware activity. This score reflects the current threat landscape for the vulnerability. For more details, see the CVSS v4.0 Specification.

The CVSSv3 Exploit Maturity Code (E) for the vulnerability the plugin covers. Possible values include:

• Unproven — Corresponds to the Unproven (U) value for the E metric

• Proof-of-concept — Corresponds to the Proof-of-Concept (POC) value for the E metric

• Functional — Corresponds to the Functional (F) value for the E metric

• High — Corresponds to the High (H) value for the E metric

• Not-defined — Corresponds to the Not Defined (ND) value for the E metric

The CVSSv3 Remediation Level (RL) temporal metric for the vulnerability the plugin covers. Possible values include:

• O — Official Fix

• T — Temporary Fix

• W — Workaround

• U — Unavailable

• X — Not Defined

The CVSSv3 Report Confidence (RC) temporal metric for the vulnerability the plugin covers. Possible values include:

• U — Unknown

• R — Reasonable

• C — Confirmed

• X — Not Defined

The CVSSv3 Access Complexity (AC) metric for the vulnerability the plugin covers. Possible values are:

• H — High

• M — Medium

• L — Low

The CVSSv2 Attack Vector (AV) metric for the vulnerability the plugin covers. Possible values are:

• Network — Corresponds to the Network (N) value for the AV metric.

• Adjacent Network — Corresponds to the Adjacent Network (A) value for the AV metric.

• Local — Corresponds to the Local (L) value for the AV metric

Level of privilege required to exploit this vulnerability. Possible values are L for low, H for high, and None for no access privileges required.

The CVSSv2 availability impact metric for the vulnerability the plugin covers. Possible values include:

• H — High

• L — Low

• N — None

The CVSSv3 confidentiality impact metric of the vulnerability the plugin covers to the vulnerable component. Possible values include:

• H — High

• L — Low

• N — None

The CVSSv3 integrity impact metric for the vulnerability the plugin covers. Possible values include:

• H — High

• L — Low

• N — None

The CVSSv2 Exploitability (E) temporal metric for the vulnerability the plugin covers. Possible values include:

• U—Unproven

• POC — Proof-of-Concept

• F — Functional

• H — High

• ND — Not Defined

The CVSSv2 Remediation Level (RL) temporal metric for the vulnerability the plugin covers. Possible values include:

• OF — Official Fix

• TF — Temporary Fix

• W — Workaround

• U — Unavailable

• ND — Not Defined

The CVSSv2 Report Confidence (RC) temporal metric for the vulnerability the plugin covers. Possible values include:

• UC — Unconfirmed

• UR — Uncorroborated

• C — Confirmed

• ND — Not Defined

The CVSSv2 Access Complexity (AC) metric for the vulnerability the plugin covers. Possible values include:

• H — High

• M — Medium

• L — Low

The CVSSv2 Access Vector (AV) metric for the vulnerability the plugin covers. Possible values include:

• L — Local

• A — Adjacent Network

• N — Network

The CVSSv2 Authentication (Au) metric for the vulnerability the plugin covers. Possible values include:

• N — None

• S — Single

• M — Multiple

The CVSSv2 availability impact metric for the vulnerability the plugin covers. Possible values include:

• N — None

• P — Partial

• C — Complete

The CVSSv2 confidentiality impact metric for the vulnerability the plugin covers. Possible values include:

• N — None

• P — Partial

• C — Complete

The CVSSv2 integrity impact metric for the vulnerability the plugin covers. Possible values include:

• N — None

• P — Partial

• C — Complete

Filter on the VPR v2 score percentile ranking of the CVE, indicating its position relative to other vulnerabilities.

Filter on the VPR v2 severity categorization of the CVE. Options are Critical, High, Medium, Low, Info.

Filter on the probability of exploitation produced by the VPR v2 threat model for the CVE.

Filter on current availability and maturity of exploit code. Options are High, Functional, POC, and Unproven.

Filter on whether the CVE is listed on the CISA Known Exploited Vulnerabilities list. Options are Yes, No.

Filter on categories of news sources that have referenced the CVE within the last 30 days. Select from one or more of Academic and Research Institutions, Blogs and Individual Researchers, Code Repositories, Cybersecurity News Media, Cybersecurity Vendors, Forums and Community Platforms, Government and Regulatory, Mainstream News and Media, Security Research, Technology Companies, Tools and Resources, Other.

Filter on the volume of observed malware exploiting the CVE within the last 30 days. Options are Very Low, Low, Medium, High, Very High.

Filter on the recency of observed malware exploiting the CVE. Options are No Recorded Events, 60 to 180 days, 30 to 60 days, 14 to 30 days, 7 to 14 days, 0 to 7 days.

Allows filtering on specific industries where attacks leveraging the CVE have been observed. Sample options include Banking, Technology, Government.

Allows filtering on specific geographic regions where attacks leveraging the CVE have been observed.

The workaround action required to remediate the vulnerability. Possible workaround types include:

• Configuration Change — You must alter the configuration of software on the asset.

• Disable Service — You must disable a service on the asset.

The code for the severity assigned when a user recast the risk associated with the vulnerability. Possible values include:

• 0 — The vulnerability has a CVSS score of 0, which corresponds to the "info" severity level.

• 1 — The vulnerability has a CVSS score between 0.1 and 3.9, which corresponds to the "low" severity level.

• 2 — The vulnerability has a CVSS score between 4.0 and 6.9, which corresponds to the "medium" severity level.

• 3 — The vulnerability has a CVSS score between 7.0 and 9.9, which corresponds to the "high" severity level.

• 4 — The vulnerability has a CVSS score of 10.0, which corresponds to the "critical" severity level.

The type of modification a user made to the vulnerability's severity. Possible values include:

• none — No modification has been made.

• recasted — A user in the Vulnerability Management user interface has recast the risk associated with the vulnerability

• accepted — A user in the vulnerability Management user interface has accepted the risk associated with the vulnerability.

The state of the vulnerability as determined by the Tenable Vulnerability Management state service. Possible values include:

• OPEN — The vulnerability is currently present on an asset.

• REOPENED — The vulnerability was previously marked as fixed on an asset, but has been detected again by a new scan.

• FIXED — The vulnerability was present on an asset, but is no longer detected.

The source of the scans that identified the vulnerability. Sources can include sensors, connectors, and API imports. The values in the source field correspond to the names of the sources as defined in your organization's implementation of Tenable Vulnerability Management.

Commonly used source names include:

• AGENT — The vulnerability data was obtained from a Tenable Agent scan.

• NNM — The vulnerability data was obtained from a Tenable Network Monitor scan.

• NESSUS — The vulnerability data was obtained from a Tenable Nessus scan.