CVSS Lab
Score three findings from YOUR $LAB_ASSETS scan export — NVD lookup, no exploit PoCs.
Visual · t18_cvss_lab
Lab: CVSS read + annotate on $LAB_ASSETS export. Original Cyberlium.
Three vector strings from your lab CSV beat memorizing every CVSS metric from a poster.
From YOUR latest $LAB_ASSETS scan export (Nessus/OpenVAS or course scanner on RoE hosts): (1) pick three findings with different Base bands; (2) copy CVSS vector from scanner or NVD; (3) write plain-English Base metric summary for each; (4) add one Environmental note per finding using YOUR asset inventory tags. Save notes chmod 600 under $HOME/cyberlium-lab. No exploit PoCs, no rescans of stranger networks to 'get better CVEs,' no publishing raw scan of third-party infrastructure.
1. Export selection
Use scan from Module 4–5 lab on $LAB_ASSETS only — redact IPs if sharing mentor.
Record plugin ID, CVE, Base score, vector string per finding.
Command guide
Try these commands — Export selection
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CVSS lab — https://www.first.org/cvss/calculator/3.1 NVD — https://nvd.nist.gov
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install curl
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS 'https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228' | jq '.vulnerabilities[0].cve.metrics.cvssMetricV31[0].cvssData.baseScore' >> "$HOME/cyberlium-lab/t18-cvss-lab.txt" cat > "$HOME/cyberlium-lab/t18-cvss-lab.txt" <<'EOF' finding: example lab service outdated base: (from NVD jq above) environmental_note: lab isolated — lower urgency than prod EOF
Command — copy this
grep base "$HOME/cyberlium-lab/t18-cvss-lab.txt"
Primary tools to practice this lesson: jq, curl. Reference sites: CVSS lab (https://www.first.org/cvss/calculator/3.1); NVD (https://nvd.nist.gov). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Annotation
Plain English: AV, AC, worst impact (C/I/A). Environmental: asset role and adjusted priority.
Note if Temporal would change urgency — no exploit download required.
3. Teardown
Store notes chmod 600. Do not commit scan exports with live internal IPs to public repos.
No attaching exploit links to mentor submission.
4. What you ship: CVSS lab pack
Three annotated findings + environmental notes — chmod 600.
5. What you record before the next lesson
CVSS lab notes path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run exploit PoC to 'validate' CVSS impact on neighbor router.
- Right: CVSS annotations on $LAB_ASSETS export. Next: quiz.
Mission: CVSS lab
1) Three findings from YOUR scan export. 2) Vector + plain-English metrics each. 3) Environmental note; secure notes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Scanner CVSS vs NVD mismatch?”
APPLY: CVSS lab uses:
APPLY: True or False: Exploit PoCs required for CVSS lab credit.
APPLY: After CVSS lab: