Evaluating vulnerability risk using CVE and CWE
In this unit you'll learn:
- How GitHub security alerts use vulnerability metadata to help prioritize remediation.
- What CVE identifiers, CWE classifications, and severity scores represent.
- How these indicators help teams evaluate risk and decide which vulnerabilities to address first.
Consider the following scenario: A development team reviewing security alerts sees two vulnerabilities:
- A dependency vulnerability with a high CVSS score
- A code scanning alert referencing a low-severity CWE classification
Both alerts require remediation, but addressing the most significant risk first is essential.
Understanding vulnerability metadata helps teams determine which vulnerabilities require immediate attention.
Understanding vulnerability metadata
Security alerts include structured metadata that helps teams evaluate vulnerability risk. GitHub integrates vulnerability information from widely used industry standards, including:
- CVE - Common Vulnerabilities and Exposures
- CWE - Common Weakness Enumeration
- CVSS - Common Vulnerability Scoring System
These frameworks provide standardized context for evaluating vulnerabilities.
CVE identifiers
A CVE identifier represents a publicly documented vulnerability affecting software. GitHub dependency alerts often reference CVE records from the GitHub Advisory Database. These records describe the affected package versions, vulnerability details and remediation recommendations Because CVE identifiers are widely used across security tools, organizations can correlate GitHub alerts with external vulnerability intelligence.
CWE classifications
CWE classifications describe the category of vulnerability rather than a specific instance.
| CWE | Description |
|---|---|
| CWE-89 | SQL injection |
| CWE-79 | Cross-site scripting |
| CWE-798 | Hard-coded credentials |
Recognizing recurring CWE patterns helps organizations identify systemic security issues.
Severity scoring with CVSS
CVSS provides a standardized severity score representing the potential impact of a vulnerability.
| Severity | CVSS Score |
|---|---|
| Critical | 9.0–10 |
| High | 7.0–8.9 |
| Medium | 4.0–6.9 |
| Low | 0.1–3.9 |
Organizations often align remediation timelines with severity levels.
After prioritizing vulnerabilities, development teams must determine how remediation should occur. In the next unit, you'll explore how organizations align remediation workflows with vulnerability severity.