Vulnerability Assessment

Vulnerability Assessment

Assess a specific vulnerability's impact on the organization.

When to Use

• New CVE announced that might affect the stack
• User asks about a specific vulnerability
• Post-incident review of exploited vulnerabilities

Steps

1. Look up the CVE details (CVSS score, affected versions, attack vector)
2. Check against the organization's known technology stack
3. Assess exposure: is the vulnerable component deployed, internet-facing, or configured to be exploitable
4. Determine remediation: patch available, workaround, or mitigation
5. Provide clear action plan with timeline

Output Format

## Vulnerability Assessment -- [CVE ID]

| Field | Detail |
|-------|--------|
| **CVE** | [ID] |
| **CVSS** | [Score] / 10 |
| **Affects** | [Software and versions] |
| **Your Exposure** | [Yes/No -- which component, which environment] |
| **Exploitation** | [Active / PoC available / Theoretical] |

### Impact
[What an attacker could do if exploited]

### Remediation
1. [Primary fix -- patch version]
2. [Workaround if patch not immediate]
3. [Monitoring steps while unpatched]

### Timeline
- **Immediate**: [What to do now]
- **This Week**: [Scheduled remediation]
- **Ongoing**: [Verification and monitoring]