5 ways to fix misleading vulnerability severities with policy

GitLab vulnerability management policies can now automatically override default Common Vulnerability Scoring System (CVSS) severity levels based on custom conditions. This allows organizations to adjust vulnerability severity levels to reflect their actual risk model, rather than relying on a generic one.

Overview

A typical enterprise vulnerability report surfaces hundreds of findings per scan cycle, all ranked by CVSS. However, CVSS describes the theoretical characteristics of a Common Vulnerabilities and Exposures (CVE), not whether it matters in a specific environment. GitLab's severity override policies address this issue by enabling organizations to define rules with match criteria and an override action.

What it does

Severity override policies work by adjusting vulnerability severity levels automatically on every default-branch pipeline. Users define rules with match criteria (CVE ID, CWE ID, file path, or directory) and an override action. When a vulnerability matches, GitLab's Security Policy Bot updates its severity immediately. Three override operations are available: Set Severity, Increase Severity, and Decrease Severity.

Use cases

Several use cases are provided, including:

1. Downgrade low-risk CVEs in internal services: Decrease the severity of specific CVEs found in internal service directories.
2. Upgrade injection vulnerabilities in production code: Set the severity to Critical for XSS and SQLi findings in production code.
3. Normalize severity across scanners: Enforce a consistent baseline by setting a specific severity level for a CVE family.
4. Align severity with exploitation intelligence: Upgrade Medium-severity CVEs that are actively exploited or have a high exploitation probability.
5. Apply org-wide risk models at the group level: Apply severity override policies at the group level, affecting every project in the group.

To get started, users can follow these steps:

1. Identify the mismatch in their vulnerability report.
2. Pick one use case and record the baseline severity distribution.
3. Create and apply a policy using the provided configurations.
4. Validate the results after the next default-branch pipeline.

In summary, GitLab's severity override policies provide a powerful tool for organizations to customize their vulnerability severity levels and reflect their actual risk model. By following the provided use cases and steps, users can create and apply effective policies to improve their vulnerability management.