Introduction to vulnerabilities: CVE, CVSS and patching
You learn what a vulnerability is, its shared language (CVE, CWE, CVSS) and its life cycle; you read vendor advisories, list installed versions, apply patches and verify they are in place.
Level 101 · 14 lessons · 12 practice labs
Lessons
What a vulnerability is
- What a vulnerability is: a house with a door left open
- Kinds of vulnerability: software bugs, misconfiguration, weak passwords
- The life of a vulnerability: discovery, disclosure, patch, deployment
- Short task: classify ten short incidents by vulnerability type
The shared language
- The CVE identifier: a common name for vulnerabilities
- CWE: the root-cause type of a vulnerability
- Reading a CVSS score: the base metrics
- Reading vendor security advisories
- Searching vulnerability databases
- Short task: find the CVE records that apply to a package version
Patching
- Listing installed package versions
- Applying updates and the need to restart
- Verifying that a patch is applied
- Capstone: list a lab server’s vulnerabilities, patch them and verify
Practice labs
- Classify ten incident notes by vulnerability type: Sort Ayçiçeği Gıda's incident notes into software flaw, misconfiguration and weak password, and fill in the table.
- Group the vulnerabilities in this server's audit notes by type: Group the findings in Tarçınlı Fırın's server audit notes by type and root cause, and write one fix direction for each group.
- Place each finding on the vulnerability life cycle: Decide whether each item in Karaçam Mobilya's finding list is at discovery, disclosure, patch or deployment stage, and flag the stuck ones.
- Find the CVE records for this package version: Search the lab server's package version in the local vulnerability database and list the CVE IDs that affect it.
- Map five CVE records to their CWE root-cause type: Read the five CVE descriptions, assign each the right CWE type and justify it in one sentence.
- Compare a vendor advisory with the CVE record and confirm affected versions: Compare the advisory and CVE record for the component Kumsal Turizm uses, and state with evidence whether the installed version is affected.
- Read this CVSS vector and calculate the score: Explain each metric of the given CVSS base vector in plain words and confirm the score with the calculator.
- Score three findings with CVSS base metrics: Choose base metrics for three Gelincik Okulları findings, write the vectors and set the severity.
- Explain why two CVSS scores differ and defend the right one: Compare the different vectors two sources gave the same vulnerability and argue which fits your environment.
- List the installed package versions on this server: Export the installed packages and versions on the lab server and flag those with pending security updates.
- Apply the updates and decide which services need a restart: Apply the security updates, find services still using the old library and restart them.
- Patch a lab server, verify it and close its vulnerability list: Build the vulnerability list for Mercanköşk Otelcilik's server, apply patches and close each item with version and service evidence.
About this course
You learn what a vulnerability is, its shared language (CVE, CWE, CVSS) and its life cycle; you read vendor advisories, list installed versions, apply patches and verify they are in place.
What you will learn
- What a vulnerability is
- The shared language
- Patching
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.