How to Read a CVE Record and CVSS Score

Every vulnerability page on GhostLayer follows the same structure. Here is how to read one quickly and decide what to do.

The CVE identifier

A CVE ID such as CVE-2024-12345 is a unique name assigned by a CVE Numbering Authority. The year is when the ID was reserved, not necessarily when the flaw was disclosed.

CVSS base score and vector

The Common Vulnerability Scoring System rates technical severity from 0 to 10: Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0). The vector string explains the score:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N  attack vector: network
AC:L  attack complexity: low
PR:N  privileges required: none
UI:N  user interaction: none
C/I/A impact on confidentiality, integrity, availability: high

Severity is not the same as risk

A Medium-severity bug that is being actively exploited can matter more than an unexploited Critical one. That is why we show exploitation status and whether a CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Always check the source

Each record links to the NVD entry and to vendor advisories. Use those for exact affected versions and patches.