Which of the following is a limitation of the Common Vulnerability Scoring System (CVSS) as it relates
to conducting code review?
A.
It has normalized severity ratings.
B.
It has many worksheets and practices to implement.
C.
It aims to calculate the risk of published vulnerabilities.
D.
It requires a robust risk management framework to be put in place.
I don’t understand how the answer C is a limitation rather than a feature of CVSS.
I don’t think answer is correct here as well,
CVSS score is assigned only to known/published vulnerabilities. During code review, you’re (in most cases) looking for zero-day vulnerabilities.
Answer is completely correct.
vulnerabilities when become public known by All , you will see it in CVSS.
this is compared to zero-day vulnerabilities!!!
when vulnerabilities become known, then it has been rated after code reviews
my personal opinion
I think answer is correct.
No pr at all.