Ukuthola amaphuzu e-CVE kanye nokuphepha kwe-CVE kubalulekile ekuvikeleni izinhlelo zokusebenza zesofthiwe zesimanje ezinsongweni ze-cyber ezivelayo. Ukuhlonza nokubeka phambili ubuthakathaka ngempumelelo kuvumela izinhlangano ukuthi zibhekane nezingozi ezibucayi kakhulu kuqala. Ukuthola amaphuzu e-CVE kunikeza i- standardindlela ehlanganisiwe yokubeka ubuthakathaka ngokwezinga, kuyilapho imikhuba yokuphepha ye-CVE iqinisekisa ukuthi lezo zingozi ziphathwa kahle futhi zincishiswa.
Ngo 2025, Kushicilelwe ama-CVE angu-48,185, ukwenyuka okungu-20.6% kusuka ku-39,962 ka-2024, kanye no-38% kwalinganiswa ngokuthi ubukhali obukhulu noma obubucayi. Njengoba ivolumu ikhula ngokushesha kangaka, ukuba ne-CVE scoring eqinile kanye nesu lokuphepha akusekho ukukhetha; kuyisidingo.
Inkinga enkulu akuyona nje ivolumu, ukuthi ukuhlaziywa kwendabuko akukwazi ukuhambisana nayo. I-NVD ye-NIST icebise cishe ama-CVE angu-42,000 ngo-2025, okungu-45% ngaphezu kwanoma yimuphi unyaka odlule, kodwa lokho kwakunganele ukuhambisana nokuthunyelwa okukhulayo. Njengomphumela oqondile, ama-28% kuphela ama-CVE asanda kudalulwa ngo-2025 athole ukucetshiswa okugcwele kwe-NVD (amaphuzu e-CVSS, ukuhlukaniswa kwe-CWE, idatha ye-CPE), kwehle kakhulu kusuka ku-46.2% ngo-2024. Lezi zinombolo ziqokomisa ukuphuthuma okukhula kwezinhlangano ukuba zibe nezinyathelo zazo zokuphepha ze-CVE endaweni, kunokuthembela kuphela kudatha ye-NVD efika ngesikhathi.
Kuyini Ukulinganisa I-CVE Futhi Kungani Kubalulekile Ekuphepheni Kwe-CVE?
I-CVE imele i-Common Vulnerability kanye ne-Exposures, uhlu lobuthakathaka kanye nokuchayeka okudalulwe esidlangalaleni kwezokuphepha kwe-inthanethi. Okufakiwe ngakunye ohlwini lwe-CVE kuthola isihlonzi esiyingqayizivele esibizwa ngokuthi i-CVE ID, esibhekisela ngqo kubuthakathaka. I-MITRE Corporation ilawula lolu hlelo, standardukucacisa ukuthi ubuthakathaka buhlonzwa futhi buhlelwa kanjani. Lokhu kuqinisekisa ukuthi wonke umuntu osebenza kwezokuphepha kwe-inthanethi usebenzisa ireferensi efanayo lapho exoxa ngezinsongo ezithile.
Ukuthola amaphuzu e-CVE kuhilela ukuhlola ukungena ngakunye kwe-CVE nokunikeza amaphuzu ezinombolo ngokusekelwe ebunzimeni bawo. Leli maphuzu lisiza izinhlangano ukuthi zinqume izinga elibalulekile lokubhekana nobuthakathaka.
Ibavumela ukuthi bahlukanise izinsiza ngempumelelo futhi banciphise izingozi ezingaba khona. Uhlelo lokuhlola i-CVE luhlola izici ezifana nokusebenziseka kalula. Luphinde lucabangele umthelela ekugcinweni kwemfihlo, ubuqotho, kanye nokutholakala (okuvame ukubizwa ngokuthi “i-CIA triad”). Ngaphezu kwalokho, luhlola amathuba okulungisa.
Indlela i-NVD, uhlu lwe-MITRE CVE, kanye nokulinganisa i-CVE okusebenza ngayo ndawonye
Ukuqonda ukuxhumana phakathi kweNational Vulnerability Database (NVD), Uhlu lwe-MITRE, kanye nokuphepha kwe-CVE kubalulekile ekuqondeni ukuthi ubuthakathaka buphathwa kanjani ohlelweni lokuphepha kwe-cyber.
Uhlu lwe-MITRE CVE luqala ngokuhlonza ubuthakathaka bese lubanika i-CVE ID. Kodwa-ke, lolu hlu luhlinzeka ngolwazi oluyisisekelo kuphela mayelana nobuthakathaka ngabunye. I-NVD, eqhutshwa yi- National Institute of Standardubuchwepheshe kanye nobuchwepheshe (i-NIST), ithuthukisa lolu lwazi ngokunikeza izincazelo ezinemininingwane, izinkomba, futhi okubaluleke kakhulu, ukuthola amaphuzu nge-CVE I-Common Vulnerability Scoring System (CVSS).
I-NVD iyisisetshenziswa esibalulekile ngoba isebenza njengendawo yokugcina izinto standardidatha yobuthakathaka esuselwe ku-s, esiza izinhlangano ukuqonda umthelela wobuthakathaka ngokuphelele. I-NVD ayihlanganisi nje kuphela amaphuzu e-CVSS kodwa futhi ifaka ulwazi olujulile olufana nalokhu:
- Izincazelo ezinemininingwane yobuthakathaka ngabunye, okuhlanganisa imininingwane yobuchwepheshe kanye nomongo lapho ubuthakathaka bungasetshenziswa khona.
- Izilinganiso zomthelela ezibonisa ukuthi ubuthakathaka bungathinta kanjani izingxenye ezahlukene zesistimu yenhlangano.
- Ulwazi lokulungisa njengezixhumanisi eziya kuma-patches, izeluleko, kanye nezindlela zokunciphisa.
Ngenxa yobuningi bayo, i-NVD iwumthombo ofanele izinhlangano lapho zidinga ukuhlola umthelela wangempela wobuthakathaka futhi ziqonde ukuthi zingabhekana kanjani nakho ngempumelelo.
I-CVSS: Uhlelo Lokuthola Amaphuzu lwe-CVE Oluvame Kakhulu Ku-Cybersecurity
Indlela esetshenziswa kakhulu yokuthola amaphuzu e-CVE yi- I-Common Vulnerability Scoring System (CVSS), igcinwe futhi yathuthukiswa yiForum of Incident Response and Security Teams (FIRST). I-CVSS inikeza standardindlela ehlelekile yokulinganisa ubukhulu bobuthakathaka, okwenza kube lula ngezinhlangano ukuthi zibeke phambili ukuthi yiziphi okufanele zibhekane nazo kuqala.
Ngokukhethekile, i-CVSS ithola amaphuzu obuthakathaka esikalini esisuka ku-0 kuya ku-10. Lapha, u-0 akameleli ingozi kanti u-10 umele izinga lobunzima obuphezulu kakhulu. Ngaphezu kwalokho, amaphuzu asekelwe emaqenjini amane amakhulu e-metric:
Isikolo Esiyisisekelo:
Lokhu kubonisa izici zangaphakathi zobuthakathaka obuhlala njalo ngokuhamba kwesikhathi nakuzo zonke izindawo zomsebenzisi. Isilinganiso esiyisisekelo sibheka izici ezifana nokuxhashazwa. Lokhu kubhekisela ekutheni kulula kangakanani ukusebenzisa ubuthakathaka. Kuphinde kuhlole umthelela ekugcinweni kwemfihlo, ubuqotho, kanye nokutholakala.
Isikolo Sesikhashana:
Lokhu kulungisa amaphuzu ayisisekelo ngokusekelwe ezintweni ezishintsha ngokuhamba kwesikhathi, njengokuthi ngabe kukhona yini ukulungiswa noma ngabe kukhona yini okusetshenziswayo. Izilinganiso zesikhashana zifaka phakathi ukuvuthwa kwekhodi yokusetshenziswa, izinga lokulungisa, kanye nokuzethemba kombiko.
Amaphuzu Ezemvelo:
Lokhu kuvumela izinhlangano ukuthi zenze ngokwezifiso amaphuzu e-CVSS ukuze abonise umthelela wobuthakathaka endaweni yazo ethile. Kucabangela izici ezifana nokubaluleka kohlelo oluthintekile kanye nomonakalo ongaba khona wezinto ezihambisanayo.
Iqembu Le-Metric Elingeziwe:
Yethulwa ku-CVSS v4.0 futhi inikeza umongo owengeziwe ongathonya ukuhlolwa kwengozi iyonke. Lokhu kufaka phakathi izinto ezicatshangelwayo ezifana nezidingo zokuphepha, amamethrikhi azenzakalelayo (alinganisa ukuthi ukuzenzekela kuthinta kanjani ukuxhashazwa), kanye nezici ezihlukile ezingase zingalingani namanye amaqembu emethrikhi. Nakuba amaphuzu e-CVSS iyonke engawafaki lawa mamethrikhi, anikeza ukuqonda okubalulekile. Ngenxa yalokho, asiza izinhlangano ukuthi zenze ulwazi oluningicisimibono mayelana nokuphatha ubuthakathaka.
Inguqulo yakamuva, I-CVSS v4.0, yethula lezi zithuthukisi ukuze kuthuthukiswe ukunemba kanye nokusebenziseka kokuthola amaphuzu okuba sengozini. Ngokulungisa amamethrikhi, i-CVSS v4.0 ibamba ubunzima kanye nomongo wobuthakathaka ngempumelelo enkulu. Lokhu kuqinisekisa ukuthi amaphuzu ahlinzeka ngokulungiselela okwengeziwecisukubonakaliswa kwengozi yangempela.
Isibonelo Somhlaba Wangempela: CVE-2021-44228 (Log4Shell)
Ukuze sibonise ukuthi ukusebenza kwe-CVE scoring kusebenza kanjani, ake sibheke i-CVE-2021-44228, eyaziwa kakhulu ngokuthi i-Log4Shell. Ubuthakathaka bomtapo wolwazi we-Apache Log4j 2 ivumela ukwenziwa kwekhodi ekude (i-RCE). Ngenxa yalokho, umhlaseli angathatha ukulawula uhlelo oluthintekile.
- I-ID ye-CVE: I-CVE-2021-44228
- Isikolo Sesisekelo se-CVSS: 10.0 (Kubalulekile)
- IVector Yokuhlasela: Inethiwekhi (N) - Ingasetshenziswa kude.
- Ubunzima Bokuhlasela: Okuphansi (L) – Kulula ukukusebenzisa.
- Amalungelo Adingekayo: Akukho (N) – Azikho amalungelo adingekayo.
- Ukusebenzisana komsebenzisi: Akukho (N) – Akukho ukuxhumana komsebenzisi okudingekayo.
- Ububanzi: Kushintshiwe (C) – Kuthinta izinsiza ezingaphezu kwamandla azo okuqala.
- Ubumfihlo, Ubuqotho, Umthelela Wokutholakala: Okuphezulu (H) - Ukuyekethisa okuphelele kobumfihlo, ubuqotho, kanye nokutholakala.
I-NVD inikeze amaphuzu e-CVSS angu-10.0, okubonisa izinga eliphezulu kakhulu lobunzima. Ukusabalala kwalokhu kusengozini, kuhlanganiswe nokulula kokuxhashazwa, kwenze kwaba yinto eza kuqala ekulungisweni emhlabeni wonke.
Izinselele Ekutholeni Amaphuzu e-CVE kanye Nomthelela Wazo Ekuphepheni kwe-CVE
Kuyilapho Ubungozi Obuvamile Nokuchayeka (i-CVE) uhlelo lunikeza a standardIndlela ethuthukisiwe yokuhlonza nokulandelela ubuthakathaka, imikhawulo eminingana ithinta ukusebenza kwayo ekuphatheni izingozi.
I-CVE-2021-44228 (Log4Shell) ibonisa lezi zinselele:
- Imininingwane Elinganiselwe Ngokuxhashazwa: I-CVE-2021-44228 inikeza isihlonzi esiyingqayizivele kodwa ayinayo imininingwane ephelele yokuthi abahlaseli bangayisebenzisa kanjani. Nakuba ochwepheshe bekubona kubalulekile, okufakiwe kwe-CVE akuchazi ngokugcwele izindlela eziqondile abahlaseli abazisebenzisayo noma ukucushwa okuthile okwandisa ubungozi. Lesi sikhala sishiya izinhlangano zingaqinisekile ngengozi yangempela.
- Ukuguquguquka Kokubika: I-CVE Amarekhodi ahlukahluka kakhulu ngokuqukethwe kanye nekhwalithi. Amanye, afana I-CVE-2021-44228, inikeza izincazelo ezinemininingwane kanye nolwazi lobuchwepheshe, kanti ezinye zihlala zimfushane noma zingaphelele. Lokhu kungahambisani kubeka inselele ezinhlanganweni lapho zizama ukuhlola ubungozi bokusengozini ngokusekelwe kuphela ekufakweni kwayo kwe-CVE.
- Ukuntuleka Kokufaneleka Komongo: I-CVE okufakiwe kusebenzisa i- standardifomethi ehlanganisiwe engase ingabonakali umongo othize wezindawo ezahlukene. Isibonelo, I-CVE-2021-44228 kuthinta izinhlelo ngendlela ehlukile kuye ngengqalasizinda yenkampani. Lokhu kungahambisani kahle kuholela ekuhlolweni kwezingozi okunganembile uma imininingwane ye-CVE ingahambisani nendawo ethile.
- Ukubambezeleka Kokudalulwa: Ngokuvamile kuba nokushiyeka phakathi kokuthola ubuthakathaka nokubufaka kusizindalwazi se-CVE. Phakathi nalesi sikhala, abahlaseli bangase basebenzise ubuthakathaka obufana nobo I-CVE-2021-44228 ngaphambi kokuba zibe sobala, okwandisa ingozi ngenxa yokubambezeleka kokuqwashisa nokulungisa.
- Gxila Ezimweni Ezibucayi Ezaziwayo: I-CVE Okufakiwe kuhlanganisa kuphela ubuthakathaka obudalulwe esidlangalaleni, okushiya ubuthakathaka obungenaso usuku kanye nezinsongo ezingadalulwanga zingatholakali. Ukuthembela kuphela ku- I-CVE iveza izinhlangano ezingozini ezivelayo ezingakafakwa ohlwini lwedathabheyisi.
- Ikhwalithi Engaguquguquki Yokungenela: Izinga I-CVE okufakiwe kuyahlukahluka kuye ngomthombo. Okunye, njengo I-CVE-2021-44228, zithola izibuyekezo ezivamile ezinemininingwane emisha, kanti ezinye zihlala zingashintshi, okuholela ekungahambelani kanye nezikhala ezingaba khona kudatha.
- I-NedVD Enrichment Backlog: Ngisho nangemva kokushicilelwa kwe-CVE, asikho isiqinisekiso sokuthi izonikezwa amaphuzu ngokushesha. Ama-CVE angu-54,914 kusukela ngo-2024-2025 ahlala emgqeni we-NVD elinde ukuhlaziywa okugcwele. Ngo-Ephreli 2026, i-NIST yamemezela ukuthi manje izobeka phambili kuphela ukucebisa ngokushesha ama-CVE ku CISIkhathalogi ka-A's Known Exploited Vulnerability (KEV), isofthiwe esetshenziswa ngaphakathi kukahulumeni wobumbano, kanye nesofthiwe ebalulekile njengoba ichazwe yi-Executive Order 14028. Konke okunye kucebiswe ngesisekelo somzamo ongcono kakhulu, okusho ukuthi izinhlangano eziningi azisakwazi ukucabanga ukuthi amaphuzu e-CVSS azotholakala lapho ziwadinga kakhulu.
I-EPSS: Ukuthuthukisa Ukuphepha kwe-CVE Kokuphathwa Okuphelele Kokusengozini
I-CVE-2021-44228 futhi kuqokomisa lapho I-Common Vulnerability Scoring System (CVSS), nakuba iqinile, iyasilela. Lokhu kushiyeka kugcizelela ukubaluleka kwe Uhlelo Lokubikezela Ukuxhaphaza (i-EPSS).
Kuyini i-EPSS?
EPSS isebenzisa uhlaka oluqhutshwa idatha ukubikezela amathuba okuxhashazwa kobuthakathaka obufana I-CVE-2021-44228 ezinsukwini ezingu-30 ezizayo. Ngokungafani I-CVSS, elinganisa umthelela ongaba khona, EPSS ilinganisela amathuba okuxhashazwa ngokusekelwe kudatha yomlando kanye nemikhuba.
Kungani i-EPSS Ibalulekile?
- Ukuthuthukiswa Kokubekwa Eqhulwini: EPSS kwenza izinhlangano zikwazi ukubeka phambili ubuthakathaka obungasekelwe nje kuphela ebunzimeni kodwa futhi nasemathubeni okuxhashazwa. Isibonelo, lapho amaqembu ezokuphepha azi ukuthi I-CVE-2021-44228 banamathuba aphezulu okuxhashazwa, bagxila emizamweni yokulungisa lapho beyidinga khona kakhulu.
- Ukuzivikela Okusebenzayo: EPSS ivumela amaqembu ezokuphepha ukuthi athathe izinyathelo zokuvimbela ubungozi obungase busetshenziswe kabi, okunciphisa ingozi yokuhlaselwa okuphumelelayo.
- Umongo we-DecisUkwenza i-ion: EPSS inikeza umongo owengeziwe wokuthi I-CVSS kukodwa nje kungase kuphuthelwe, njengokuhlonza ubuthakathaka obuqondiswe kakhulu ngabahlaseli. Lokhu kuholela ekuthuthukisweni okunolwazi nokwamasucisukwenza ama-ion.
- Ukuthuthukiswa Kwensiza: Ezinhlanganweni ezinezinsizakusebenza ezilinganiselwe, EPSS kusiza ukwabela ngempumelelo imizamo yobuthakathaka obuyisongo esikhulu, okuqinisekisa isu lokuzivikela elisebenza kahle kakhulu.
Ukulinganiselwa kwe-EPSS
Naphezu kwezinzuzo zayo, EPSS inemikhawulo. Ithembele kudatha yomlando, engase ingabonisi njalo isimo samanje sezinsongo. Ukugxila kwayo kwesikhashana ekubikezeleni ukuxhashazwa zingakapheli izinsuku ezingu-30 kungase kunganaki izinsongo zesikhathi eside.
EPSS inikeza ukuqonda okuvamile ngaphandle kokubheka umongo othize wendawo ngayinye. Okokugcina, kuncike emaphethini okuxhaphaza adlule, angase angabonakali izinguquko ezisheshayo kumasu okuhlasela noma ubuthakathaka obusanda kutholwa.
Ukulinganisela i-CVE kanye ne-EPSS ukuze kulawulwe kahle ukungakwazi ukusebenza kahle
Ukuze kuphathwe ubuthakathaka ngempumelelo, izinhlangano kumele ziqonde futhi zibhekane nemikhawulo yazo zombili I-CVSS futhi EPSSUkuhlanganisa la mathuluzi kunikeza umbono obanzi kakhulu wendawo yobuthakathaka. Le ndlela ilinganisa ubukhulu kanye namathuba okuxhashazwa, okuholela ekubekweni phambili okungcono, okwaziswayocisukwenziwa kwe-ion, kanye nemiphumela ethuthukisiwe yokuphepha kwe-inthanethi.
Ubhekana Nenselele Yokubeka Ezakho Izinto Ezibucayi Kuqala
Kuyo yonke le bhulogi, sihlole ubuqili bokuthola amaphuzu e-CVE, indima ebalulekile ye-National Vulnerability Database (NVD), nokuthi amathuluzi afana ne-Exploit Prediction Scoring System (EPSS) anezela kanjani ukujula ekuphathweni kobuthakathaka ngokubikezela amathuba okuxhashazwa. Kodwa-ke, ukuphatha ubuthakathaka ngempumelelo kudinga okungaphezu nje kokuqonda le mibono—kudinga indlela ephelele evumelana nezidingo zokuphepha zenhlangano yakho.
Cishe cishe Ubuthakathaka obaziwayo obungu-176,000, abangaphezu kuka-19,000 banesilinganiso se-CVSS esingu-9.0–10.0, okubonisa izingozi ezinkulu. Kodwa-ke, iningi—cishe u-77.5%—liwela ngaphakathi kwesilinganiso esiphakathi esingu-4.0 kuya ku-8.0. Lokhu kusatshalaliswa okubanzi kugqamisa inselele: yokubeka phambili ukuthi yiziphi izithiyo okufanele zixazululwe kuqala nokuthi ungakwenza kanjani lokho ngezinsizakusebenza ezilinganiselwe ngenkathi ugcina ukuzivikela okuqinile.
Ukuhlaziywa Kokwakheka Kwesofthiwe kaXygeni (SCA) Isixazululo sibhekana nale nselele ngokuhlanganisa amaphuzu e-CVE ne-EPSS namanye amathuluzi omongo, okukunikeza isithombe esiphelele sendawo yakho yobuthakathaka. Isixazululo sethu sihlola ngokuphelele i-codebase yakho emithonjeni eminingi, kufaka phakathi i-NPM, i-GitHub, kanye ne-OWD, ukuqinisekisa ukuthi awuphuthelwa yinoma yiziphi izinsongo zokuphepha ezingaba khona.
Indlela i-Xygeni's SCA Isixazululo Siguqula Ukuthola Amagoli kwe-CVE Kube Yisenzo
Kuma-CVE angu-48,185 ashicilelwe ngo-2025, angu-38% alinganiswe ngokuthi aphezulu noma abucayi, kanti isilinganiso se-CVSS sonyaka sasingu-6.60. Lokho kungamalebula amaningi “abucayi” kanye “aphezulu” ancintisana nezinsizakusebenza ezifanayo zokulungisa ezilinganiselwe, futhi lokho kungaphambi kokuba kubhekwe iqiniso lokuthi ama-CVE angu-2025 kuphela athole ukucebisa okuphelele kwe-NVD kwasekuqaleni.
Ukuhlaziywa Kokwakheka Kwesofthiwe kaXygeni (SCA) Isixazululo sibhekana nale nselele ngokuhlanganisa amaphuzu e-CVE ne-EPSS kanye nezimpawu ezengeziwe zomongo, sikunikeza isithombe esiphelele sendawo yakho yobuthakathaka, kungakhathaliseki ukuthi i-NVD isifinyelele ekucebiseni i-CVE ethile. Iskena i-codebase yakho ku-npm, i-GitHub, kanye nezinye irejista zomthombo ovulekile, ngakho akukho lutho oludlula lungabonakali.
Nansi indlela ehambisana ngayo nesu lakho lokuphatha ubuthakathaka:
- Ukulinganisa kwe-CVE + Ukuhlanganiswa kwe-EPSS. Ukuhlanganisa ubukhali (i-CVSS) nethuba lokuxhashazwa (i-EPSS) kusho ukuthi ithimba lakho lilungisa lokho okuxhashazwayo endle kuqala, hhayi nje lokho okunemiphumela ephezulu ephepheni.
- Ukuhlaziywa Kokufinyeleleka. I-Xygeni ayigcini ngokuthi “le CVE ikhona esihlahleni sakho sokuthembela.” Inquma ukuthi indlela yekhodi esengozini ingafinyeleleka yini kuhlelo lwakho lokusebenza, inciphise umsindo kakhulu futhi igxile ekulungiseni ingozi engasetshenziswa.
- Ukuqwashisa Ngesimo Sendawo. Ngokusebenzisa imithombo eminingi yokweluleka kanye nezinhlelo zokuthola amaphuzu ngesikhathi esisodwa, i-Xygeni iyazivumelanisa nesimo senhlangano yakho esikhundleni sokusebenzisa amaphuzu obunzima obufanayo.
- Ukuqapha Okuqhubekayo Nezaziso Zesikhathi Sangempela. Ama-CVE amasha kanye namaphuzu amasha e-EPSS ashicilelwa njalo. I-Xygeni iqapha njalo, ngakho-ke ubuthakathaka obebungabalulekile izolo, futhi busetshenziswa kabi namuhla, abunakwa.
Umphumela: njengoba ngaphezu kwengxenye yesithathu yama-CVE amasha esevele ephawulwe ngokuthi aphezulu noma abucayi, kanye nokucebisa nge-NVD kwehla kakhulu minyaka yonke, ukuhlola ngesandla konke okutholakele akulona iqiniso. I-Xygeni isiza ithimba lakho ukugxila engxenyeni encane enzima futhi engasetshenziswa ngempela endaweni yakho.
Cela i-Demo or qala Mahhala ukubona ukuthi i-Xygeni iguqula kanjani amaphuzu e-CVE abe isu lokuphatha ubuthakathaka elibekwe phambili nelisebenzisekayo.
Imibuzo Evame Ukubuzwa
Uyini umehluko phakathi kwe-CVE, i-CVSS, ne-NVD?
I-CVE iyisihlonzi esiyingqayizivele sobuthakathaka obuthile. I-CVSS (Uhlelo Lokulinganisa Oluvamile Lokuhlushwa Kwezingozi) luhlaka lokulinganisa olusetshenziswa ukukala ubukhali balobo buthakathaka kusukela ku-0 kuya ku-10. I-NVD (Isizindalwazi Sikazwelonke Sokuhlushwa Kwezingozi) yindawo yokugcina izinto, egcinwa yi-NIST, ecebisa i-CVE ngayinye ngamaphuzu ayo e-CVSS, izincazelo, kanye nezinkomba zokulungisa.
Iyini i-EPSS, futhi ihluke kanjani ku-CVSS?
I-EPSS (Exploit Prediction Scoring System) ilinganisela amathuba okuthi ubuthakathaka buzosetshenziswa ezinsukwini ezingu-30 ezizayo, ngokusekelwe kudatha yokuxhashazwa yangempela. I-CVSS ilinganisa amathuba okuba khona nobukhali uma kuxhashazwa; i-EPSS ilinganisa amathuba ukusetshenziswa kabi. Ukusebenzisa kokubili ndawonye kunikeza isignali yokubeka phambili enembile kakhulu kunanoma yikuphi kokubili.
Kungani kungesona isibalo esiphezulu I-CVSS ithola amaphuzu anele ukuze ibeke phambili ubuthakathaka?
Isikolo se-CVSS sibonisa ubukhali bethiyori, hhayi ubungozi bangempela. Ubuthakathaka "obubucayi" obunama-score angu-9.8 obungenakufinyeleleka ku-codebase yakho ethile, noma obungenakho ukuxhashazwa okusebenzayo okwaziwayo, bungaba yinto ebaluleke kakhulu kune-"medium" abahlaseli abayisebenzisayo njengamanje. Yingakho ukuhlanganisa i-CVSS ne-EPSS kanye nokuhlaziywa kokufinyeleleka kubalulekile.
Mangaki ama-CVE ashicilelwa minyaka yonke?
Inani le-CVE likhule njalo unyaka nonyaka, kanti amashumi ezinkulungwane zobuthakathaka obusha buvezwa minyaka yonke. Njengoba kunikezwe lesi silinganiso, ukuhlunga ngesandla akunangqondo ezinhlanganweni eziningi, yingakho ukubekwa phambili okuzenzakalelayo, okuqaphela umongo (i-CVSS + i-EPSS + ukufinyeleleka) sekuyinto ebalulekile.
Kuyini i-CVE-2021-44228 (Log4Shell), futhi kungani isetshenziswa njengesibonelo?
I-Log4Shell iwubungozi bokusebenzisa ikhodi ekude obubalulekile ku-Apache Log4j 2, ithole amaphuzu angu-10.0 (okuphezulu) ku-CVSS. Isetshenziswa kabanzi njengesibonelo sokufundisa ngoba ihlanganisa ukuxhashazwa okusekelwe kunethiwekhi, akukho malungelo adingekayo, kanye nokuxhumana komsebenzisi, okubonisa kahle ukuthi "okubucayi" kubukeka kanjani ngaphansi kohlaka lwe-CVSS.
