Once again: my point is that it is the opposite, because you can make lots of vulnerabilities read out this way even if they're not at all urgent --- and the opposite thing is true, very severe vulnerabilities can also get surprisingly low scores.

CVSS is literally a Ouija board. I'm not just calling it that because it's unreliable or based on superstition. I'm saying that the process of arriving at a CVSS score is Ouija-like: you fill out a calculator or something, get a score that has no relation to your intuition of the severity of the vulnerability, and start applying small bits of pressure here and there to land on the score you know the vulnerability should land on. In fact: if you don't do that, you get exceptionally dumb CVSS scores for everything. It's a mess.

If you want to call out the severity of a vulnerability, you should do so with objective facts. "Remote code execution" is a good tip-off. "CVSS 9.6" is not.

I understand what you’re saying and generally agree. We get incoming bug bounty reports like “drop everything, here’s a 9.8 you need to fix right now!” that turns out be a misunderstanding.

But in the case where multiple vendors have scores like:

- Amazon: Important (https://alas.aws.amazon.com/AL2/ALAS-2021-1619.html)

- Ubuntu: 9.8 (https://ubuntu.com/security/CVE-2021-27135)

- Red Hat: 9.6 (https://access.redhat.com/security/cve/CVE-2021-27135)

…it starts to look like there’s consensus that not only is there an RCE, but it’s really easy to exploit. I think that’s where CVSS starts to come in handy. An RCE is bad, but one that’s trivial to actually use is extra bad. And yes, CVSS absolutely has some Ouija properties, but it’s the most commonly used metric I’ve seen for communicating how bad a vulnerability actually is. In this case, it wasn’t just the reporter who said it was bad but all the affected vendors agreeing with them.

Ubuntu is just taking the score from NVD. Redhat has applied the first Ouija input to it, adjusting it to "user interaction required". That changed the score from a 9.8 --- 0.2 points from the maximum possible CVSS score --- all the way down to... 9.6.

I can't think of a better illustration of how bad CVSS is.

Once again: my point isn't that the vulnerability is unimportant (though: it's not nearly as important as it likely seems) or that it doesn't belong on the HN front page (it is a very, very funny vulnerability). It's simply that we should not be editorializing CVSS scores into titles, or taking CVSS scores seriously when they occur organically in titles.

CVSS is very, very bad. It is the CISSP of security metrics.

That ending made me LOL. Well phrased.

I had to look it up: Certified Information Systems Security Professional