Identifying and Classifying Vulnerabilities

Common Vulnerability Exposure (CVE) is an industry standard common reference classification mechanism. In this discussion you will search for a vulnerability with a particular CVSS rating and analyze that vulnerability. The National Vulnerability Database (NVD) provides a repository for vulnerabilities.

Research a current (within the last 6 months) vulnerability rated critical (CVSSv3) or high (CVSSv2). You may use the National Vulnerability Database (NVD) to find more information about the operating systems, severity level, and components that are affected by the vulnerability.

Discuss what the vulnerability is and what fixes or workarounds exist for the vulnerability.
Do you think the classification severity level truly reflects the impact of the vulnerability?
What compensating controls can we apply if for example the vulnerability can’t be patched and service turned “off”?
Elaborate at least three compensating controls. Justify your response.
Draw on the contents you read in this module to justify your perspectives. Research and include supporting materials from credible sources that support your thoughts.