Findings, severity and CVSS

A finding is one vulnerability reported against your scope. Every finding carries the same fields so you can compare and prioritise.

What a finding contains

• Title, description, impact and affected locations such as URLs or hosts.
• Severity: Critical, High, Medium, Low or Info.
• CVSS v3.1: a base score from 0.0 to 10.0 and a vector, for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
• CWE: the weakness identifier, such as CWE-79, shown as a tag.
• Steps to reproduce and proof of concept: the request, payload or code that demonstrates the issue, in a copyable block, backed by evidence files.
• Remediation guidance.

Severity and CVSS

On the CVSS Calculator tab the tester sets the eight base metrics (attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, availability) and the score is calculated. Severity bands: 0.0 Info, 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High, 9.0 to 10.0 Critical. Only base metrics are supported; temporal and environmental metrics are not.

The tester chooses the severity label, normally from the calculator, and QA reviews it before you see the finding.

The vector string stored with each finding is the authoritative record of the metrics behind its score.

Risk score

Beside severity, TrekShield shows a 0 to 100 risk score to help you order work. It combines the CVSS base score, the exploitability part of the vector and the criticality of the affected asset. Use severity for reporting and the risk score for ordering your queue.

Lifecycle

Draft, Submitted, Triaged, Reported, In remediation, Verified. Three further states exist: Risk acceptance requested, Risk accepted and Rejected.

• Draft, Submitted and Triaged are internal. You see findings from Reported onward, once the engagement is delivered.
• QA can return a submitted finding to Draft or reject it with a reason.
• Reported becomes In remediation when a remediation is assigned, and Verified when the fix is confirmed (how fixes are verified).
• Verified and Rejected are final. A Risk accepted finding can be reopened by a TrekShield engagement manager.

Findings can be linked as duplicate, variant, root cause or related from the Related tab.

Next: SLA and remediation.