# CVE Triage — Scoring & Prioritization Reference

A reference for turning `cve_lookup` output into an ordered work list.

## Severity bands (CVSS base score)

| Band | CVSS | Triage meaning |
|------|------|----------------|
| Critical | 9.0–10.0 | Drop everything; likely RCE/auth-bypass. Verify first. |
| High | 7.0–8.9 | Strong candidate; verify after criticals. |
| Medium | 4.0–6.9 | Verify if exposed and cheap to confirm. |
| Low | 0.1–3.9 | Note only; rarely worth active verification. |
| Info | 0 | Context only. |

## Prioritization order

Rank candidates by, in order:

1. **CVSS base score** — start from the band above.
2. **Exploit availability** — a public, credible PoC (Metasploit module, a
   high-star GitHub repo, an ExploitDB entry) promotes a finding above a
   higher-CVSS item with no known exploit.
3. **Exposure / reachability** — is the vulnerable component actually exposed on
   *this* target (right port, right endpoint, required preconditions met)? An
   unreachable critical is lower priority than a reachable high.
4. **Blast radius** — pre-auth > post-auth; unauthenticated network > local; RCE >
   info-leak.
5. **Cost to confirm** — when two candidates tie, verify the cheaper-to-prove one
   first to build evidence momentum.

## Version applicability check

Before recording a CVE as applicable:

- Compare the observed version against the CVE's affected `cpe` range
  (`cpe:2.3:a:vendor:product:version:...`). `cve_lookup` detail includes
  `cpe_matches`.
- Account for **backported patches**: distro packages (Debian/RHEL) often keep the
  upstream version string while patching the flaw. A version match on such a
  package is *needs-manual-review*, not *verified*.
- Account for **build flags / modules**: some CVEs require a specific module or
  configuration (e.g. `mod_cgi` enabled). If you can't confirm the precondition,
  downgrade confidence.

## Recording the finding

For each kept candidate, capture:

- `CVE-ID`, CVSS base score and vector, severity band.
- The exact recon evidence that maps this target to the CVE (banner line, header,
  endpoint).
- Applicability verdict: `verified` (exploit confirmed or version+precondition
  proven), `needs_manual_review` (version-only match), or `rejected`.
- Links: NVD references and any exploit/PoC leads (clearly marked unverified).

## What not to do

- Do not mass-assert every keyword hit as a vulnerability — that floods the report
  with noise and erodes trust in real findings.
- Do not execute third-party PoC code against a target without reading it and
  having authorization for the action it performs.
- Do not let a flashy PoC override the exposure check — unreachable is unreachable.
