Learning CNA-Oriented CVSS Scores

Software vulnerabilities are intrinsically related to product-specific characteristics. The properties of a vulnerability, along with its severity, must be assessed in the context of the product wherein the vulnerability is located. Severity is typically captured by Common Vulnerability Scoring System (CVSS) scores and context is provided by CVE Numbering Authorities (CNAs), such as vendors. In this paper, our goal is to determine how context impacts severity, i.e., how CNAs impact CVSS scores. To this aim, we pose the following question: are there latent patterns that can be learned to determine how vulnerability severity, as assessed by CVSS scores, is impacted by its context, as assessed by CNAs? To answer this question, we leverage public data from the National Vulnerability Database (NVD). We show that an LLM can learn CNA-oriented CVSS scores, achieving average classification metrics, such as accuracy and F1-scores, above 70%. Our results also indicate the potential for knowledge transfer about CVSS scores across different CNAs, within public vulnerability databases such as NVD.