CVSS information update by analyzing vulnerability information

A computing device for automatic update of a Common Vulnerability Scoring System (CVSS) score, including a non-transitory, tangible computer-readable medium with computer program instructions stored thereon, the instructions, when executed by a processor, cause the processor to:

• recognize text corresponding to preexisting vulnerability information of a vulnerability record, and
• recognize a source of vulnerability advisory information related to the preexisting vulnerability information,
• wherein the preexisting vulnerability information relates to at least one of a vulnerability or an attack vector, the vulnerability associated with a preexisting CVSS score, and the preexisting CVSS score being based at least partially on the preexisting vulnerability information;
• responsive to the recognized text corresponding to the preexisting vulnerability information, extract new vulnerability information from the source,
• wherein the new vulnerability information relates to the at least one of the vulnerability or the attack vector;
• and
• employ the new vulnerability information to update the preexisting CVSS score.

A method for automatic update of a Common Vulnerability Scoring System (CVSS) score, said method being implemented in a computing system comprising at least one physical processor, the method comprising:

• analyzing preexisting vulnerability information of a vulnerability record;
• analyzing a source of vulnerability advisory information related to said preexisting vulnerability information,
• wherein the preexisting vulnerability information relates to at least one of a vulnerability or an attack vectors, the vulnerability associated with a preexisting CVSS score, and the preexisting CVSS score including a temporal score based at least partially on the preexisting vulnerability information;
• responsive to the analyzing preexisting vulnerability information, extracting, from the source, new vulnerability information corresponding to a vulnerability property of a temporal score metric,
• wherein the new vulnerability information relates to the at least one of the vulnerability or the attack vector;
• and
• employing the new vulnerability information to update the temporal score of the preexisting CVSS score of a CVSS score record corresponding to the vulnerability record.