CSCI 2303 PRINCIPLES OF IT SECURITY THREAT REPOR

Investigator: <write your name and matric number>

Date:

INSTRUCTIONS
Part 1 - Choose the Attack Type (from the drop-down menu), fill-up the table based on the chosen attack, and sum
Part 2 - Choose the Environment Type (from the drop-down menu), fill-up the table based on the chosen environm

PART 1
Information Disclosure

No CVE ID Vendor/Product Vulnerability Description

VMware vCenter Server Remote
e.g. CVE-2021-21985 Vmware Code Execution
1
2
3
4
5

SUMMARY
Map the CVEs above to the principles of the CIA triad (Confidentiality, Inte
e.g. Integrity: The vulnerability could result in a compromise of data integrity. An attacker exploiting this vulnerabil
incorrect configurations or unauthorized changes within the vCenter Server environment.

<write your answer here>

PART 2
< CHOOSE THE ENVIRONMENT >

No CVE ID Vendor/Product Vulnerability Description

Missing input validation in the file

upload mechanism allows
e.g. CVE-2022-24796 RaspberryMatic unauthenticated attackers with
network access to the WebUI
interface
 1
2
3
4
5

SUMMARY
Map the CVEs above to the principles of the CIA triad (Confidentiality, Inte
e.g. Availability: The vulnerability may impact the availability of the system or service. An attacker exploiting the
downtime or unavailability for legitimate users, violating the availa

<write your answer here>

TOOLS TO UTILIZE:

1. National Vulnerability Database (NVD): https://nvd.nist.gov/

The NVD is the official U.S. government repository of standards-based vulnerability management data.

2. CVE Details: https://www.cvedetails.com/

CVE Details is a comprehensive CVE database that provides detailed information about each vulnerability

3. MITRE CVE List: https://cve.mitre.org/

The official CVE database maintained by MITRE, the organization that manages the CVE program.

4. NIST NVD CVE Search: https://nvd.nist.gov/vuln/search

The NIST NVD search interface allows you to search for specific CVEs and provides detailed information a

5. Vulners CVE Search: https://vulners.com/

Vulners provides a search engine for CVEs and vulnerabilities with various search filters and options.
SECURITY THREAT REPORT (ASSIGNMENT 1)

INSTRUCTIONS
based on the chosen attack, and summarize your findings
table based on the chosen environment, and summarize your findings

nformation Disclosure << click here

Potential Impact Mitigation CVSS Base Score CVSS Severity

Remote code Apply the patch provided by
execution VMware 9.8 Critical

SUMMARY
of the CIA triad (Confidentiality, Integrity, and Availability)
An attacker exploiting this vulnerability could modify or tamper with data, potentially leading to
vironment.

rite your answer here>

OSE THE ENVIRONMENT > << click here

Potential Impact Mitigation CVSS Base Score CVSS Severity

Remote code
Update to latest version 10 High
execution
 SUMMARY
of the CIA triad (Confidentiality, Integrity, and Availability)
or service. An attacker exploiting the vulnerability could potentially disrupt the system, leading to
r legitimate users, violating the availability principle.

rite your answer here>

ed vulnerability management data.

information about each vulnerability.

t manages the CVE program.

and provides detailed information about each one.

arious search filters and options.

Privilege escalation
Man-in-the-Middle
Information Disclosure
Memory Corruption
Authentication Bypass
Input validation

Mobile Applications
Embedded Systems and IoT Devices
Operating Systems
Industrial Control Systems
Databases