Thread

1. tptacek · 1790096527 · focus · HN ↗

   These CVSS scores don't mean anything and it would be better for everyone if they stopped showing up in headlines. This is a somewhat situational Wordpress RCE that impacts only a couple themes.

   1. paulez · 1790097194 · focus · HN ↗

      This score specifically means that given some specific conditions, anyone can execute code over the network on a vulnerable WordPress setup. Is this not true?

      1. tptacek · 1790097560 · focus · HN ↗

         I'm not saying that the vulnerability isn't severe or important to people running Wordpress, only that CVSS scores are literally a Ouija Board that can come out to whatever the user wants them to.

         1. ferngodfather · 1790100331 · focus · HN ↗

            Yeah give me a vuln and I can make it anything between a 2 and 8 quite easily. I routinely see 10s that are "Critical 10.0 CVE (but only if you're using X language with X setting changed from default, and the attacker can MiTM your traffic)"

Unofficial Hacker News client; not affiliated with Y Combinator.