{"action":"created","issue":{"url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/201","repository_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy","labels_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/201/labels{/name}","comments_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/201/comments","events_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/201/events","html_url":"https://github.com/bugcrowd/vulnerability-rating-taxonomy/issues/201","id":384487768,"node_id":"MDU6SXNzdWUzODQ0ODc3Njg=","number":201,"title":"\"Using Components with Known Vulnerabilities\" Should be 'Varies'","user":{"login":"leifdreizler","id":909567,"node_id":"MDQ6VXNlcjkwOTU2Nw==","avatar_url":"https://avatars0.githubusercontent.com/u/909567?v=4","gravatar_id":"","url":"https://api.github.com/users/leifdreizler","html_url":"https://github.com/leifdreizler","followers_url":"https://api.github.com/users/leifdreizler/followers","following_url":"https://api.github.com/users/leifdreizler/following{/other_user}","gists_url":"https://api.github.com/users/leifdreizler/gists{/gist_id}","starred_url":"https://api.github.com/users/leifdreizler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leifdreizler/subscriptions","organizations_url":"https://api.github.com/users/leifdreizler/orgs","repos_url":"https://api.github.com/users/leifdreizler/repos","events_url":"https://api.github.com/users/leifdreizler/events{/privacy}","received_events_url":"https://api.github.com/users/leifdreizler/received_events","type":"User","site_admin":false},"labels":[{"id":770501092,"node_id":"MDU6TGFiZWw3NzA1MDEwOTI=","url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/labels/needs%20discussion","name":"needs discussion","color":"eda67b","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-11-26T20:00:24Z","updated_at":"2018-12-20T17:21:19Z","closed_at":null,"author_association":"NONE","body":"I know there is some [hesitancy](https://github.com/bugcrowd/vulnerability-rating-taxonomy/issues/183) to label things as `Varies`, but I think that the priority for using a component w/ known vulns should be based on the underlying priority.\r\n\r\nI'm not suggesting this should be an automatic direct mapping (high component vuln -> high VRT rating). The likelihood of exploit and impact of where this component is being used should still be taken into account, etc. \r\n\r\nIf anything should be categorized as `Varies`, it should be something as variable as this finding because the underlying component could have vuln(s) ranging from P0-P5"},"comment":{"url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/comments/449072859","html_url":"https://github.com/bugcrowd/vulnerability-rating-taxonomy/issues/201#issuecomment-449072859","issue_url":"https://api.github.com/repos/bugcrowd/vulnerability-rating-taxonomy/issues/201","id":449072859,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0OTA3Mjg1OQ==","user":{"login":"plr0man","id":24785104,"node_id":"MDQ6VXNlcjI0Nzg1MTA0","avatar_url":"https://avatars0.githubusercontent.com/u/24785104?v=4","gravatar_id":"","url":"https://api.github.com/users/plr0man","html_url":"https://github.com/plr0man","followers_url":"https://api.github.com/users/plr0man/followers","following_url":"https://api.github.com/users/plr0man/following{/other_user}","gists_url":"https://api.github.com/users/plr0man/gists{/gist_id}","starred_url":"https://api.github.com/users/plr0man/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/plr0man/subscriptions","organizations_url":"https://api.github.com/users/plr0man/orgs","repos_url":"https://api.github.com/users/plr0man/repos","events_url":"https://api.github.com/users/plr0man/events{/privacy}","received_events_url":"https://api.github.com/users/plr0man/received_events","type":"User","site_admin":false},"created_at":"2018-12-20T17:21:19Z","updated_at":"2018-12-20T17:21:19Z","author_association":"CONTRIBUTOR","body":"We do get quite a few reports that have improperly assigned VRT entries, which often results in a higher severity rating being preassigned to such submissions. That is of course corrected by the ASEs.\r\nIn case of the \"varies\" VRT entries, there's currently no way for the researchers to preassign a suggested severity rating. We've tried that in the past and it didn't prove itself to be reliable as the vast majority of such reports ended up being submitted with overestimated ratings. It's best to explain the security risk in the report and let the ASE work out a fair assessment."}}
{"actor":{"display_login":"plr0man"}}