Real-world analysis finds the severity of many CVEs is overrated
The latest report from JFrog looks at the most prevalent vulnerabilities in 2022 with an in-depth analysis of open source security vulnerabilities that have most impact for DevOps and DevSecOps teams.
The report shows that the severity of six of the top 10 CVEs was overrated, meaning they scored higher in the NVD rating than in JFrog's own analysis. In addition the CVEs appearing within enterprises most frequently are low-severity issues that were simply never fixed.
Of the top 50 prevalent CVEs found in Artifactory, 64 percent were overrated, 26 percent were equal, and 10 percent were actually underrated.
It takes roughly 246 days to remediate a security issue and most organizations have limited resources, so the ability to correctly identify and prioritize mitigation of the most severe vulnerabilities is crucial.
JFrog's analysis is based on real-world, anonymized data from JFrog Artifactory, the company's software repository used by more than 7,000 global customers to securely manage artifacts, binaries, and other items in the software supply chain. This anonymized data provides a view of real-world usage by leading companies, revealing the issues that are most likely to affect software companies worldwide.
"The current CVSS system is flawed since vulnerability scores are not always truly verified before published," says Shachar Menashe, senior director, security research at JFrog. "The majority of the vulnerabilities detailed in this report were harder to exploit than reported, and so were undeserving of their high NVD severity rating. Vulnerabilities should be assessed by both real-world impact as well contextual analysis -how exploitable is the CVE in your local environment? It is unconscionable when CNAs assign a high criticality that is newsworthy but unfounded, causing organizations to waste valuable time and resources to mitigate a vulnerability that is extremely unlikely to have any real-world impact on their systems."
You can find out more on the JFrog site.
Image credit: nicescene/depositphotos.com