{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/vulnerability","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/vulnerability/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/vulnerability/"},"term":{"en":"Vulnerability","da":"Sårbarhed"},"aka":{"en":["weakness","security flaw"],"da":["svaghed","sikkerhedshul"]},"domain":["security"],"cluster":"fundamentals","status":"current","summary":{"en":"A weakness that a threat can use to cause harm.","da":"En svaghed, som en trussel kan udnytte til at gøre skade."},"body":{"formal":{"en":"A flaw in a system, a process or human behaviour that a threat could use to damage the confidentiality, integrity or availability of information. Known software flaws are listed publicly with an ID and a severity score.","da":"En fejl eller mangel i et system, en proces eller menneskelig adfærd, som en trussel kan udnytte til at ramme informationens fortrolighed, integritet eller tilgængelighed. Kendte softwarefejl offentliggøres med et ID og en score for alvor."},"plain":{"en":"Like a window left open or a lock that is easy to pick - nothing bad has happened, but the way in is there.","da":"Som et vindue, der står åbent, eller en lås, der er nem at dirke op - der er ikke sket noget endnu, men vejen ind er der."},"inPractice":{"en":"An old version of an office program at a Danish school has a known flaw; until the IT coordinator installs the update, a specially made document sent by email can take over a teacher's computer.","da":"En gammel version af et kontorprogram på en skole har en kendt fejl; indtil IT-vejlederen installerer opdateringen, kan et særligt udformet dokument sendt pr. mail overtage en lærers computer."},"whyItMatters":{"en":"Threats are mostly outside your control, but weaknesses are yours to find and fix - that is where most protective work happens.","da":"Truslerne er for det meste uden for din kontrol, men svaghederne er dine egne at finde og lukke - det er dér, det meste beskyttelsesarbejde foregår."}},"deepDive":{"en":"In security engineering a vulnerability is a specific weakness in a system, process or human behaviour that a threat can exploit to compromise confidentiality, integrity or availability. Publicly known software and hardware flaws are tracked through an ecosystem of identifiers. A CVE (Common Vulnerabilities and Exposures) ID, assigned by a CVE Numbering Authority, names a particular flaw in a particular product; a CWE (Common Weakness Enumeration) names the underlying class of defect (for example CWE-79 cross-site scripting or CWE-89 SQL injection), so many CVEs share one CWE root cause. The US National Vulnerability Database (NVD) enriches CVE records, and since May 2025 ENISA operates the European Vulnerability Database (EUVD), established under the NIS2 Directive, as an EU-maintained source that cross-references existing databases.\n\nSeverity is communicated with the Common Vulnerability Scoring System (CVSS), which produces a 0-10 score from a vector of metrics. The base metrics (attack vector, attack complexity, privileges required, user interaction, scope, and impact to confidentiality, integrity and availability) describe intrinsic severity; temporal and environmental metrics adjust for exploit maturity and the specific deployment. CVSS v3.1 remains widely used, and v4.0 was published in 2023 to address criticisms and add finer granularity. A crucial nuance is that CVSS measures technical severity, not risk: it does not tell you how likely the flaw is to be exploited in your environment, which is why prioritisation increasingly adds EPSS (the Exploit Prediction Scoring System, a probability that a CVE will be exploited in the wild) and CISA's Known Exploited Vulnerabilities (KEV) catalogue, which lists flaws with confirmed active exploitation and should be patched first regardless of CVSS.\n\nVulnerabilities are found through code review, SAST and DAST, dependency and container scanning (software composition analysis), penetration testing and bug-bounty research. Handling them well means Coordinated Vulnerability Disclosure (ISO/IEC 29147 for receiving reports and 30111 for handling them), in which a researcher privately notifies the vendor, a fix is prepared, and details are published together with the patch; NIS2 Article 12 established an EU coordinated-disclosure framework and the CSIRT role in it. Operationally, vulnerability management is a continuous lifecycle - asset inventory, scanning, prioritisation, remediation and verification.\n\nTwo misconceptions recur. First, that a high CVSS score always means urgent action: a critical flaw with no known exploit and no exposure to attackers may rank below a medium flaw that is being exploited today, which is why exploitability and exposure, not severity alone, drive good prioritisation. Second, that a vulnerability is purely a software bug; misconfiguration, weak processes and human susceptibility (the target of social engineering) are vulnerabilities too, and often the most exploited. A vulnerability differs from a threat (the potential cause of harm that must find a weakness to act on) and from an exploit (the concrete technique or code that leverages the weakness); a zero-day is simply a vulnerability for which no patch yet exists when it is first exploited.","da":"I sikkerhedsteknisk sammenhæng er en sårbarhed en konkret svaghed i et system, en proces eller menneskelig adfærd, som en trussel kan udnytte til at kompromittere fortrolighed, integritet eller tilgængelighed. Offentligt kendte software- og hardwarefejl spores gennem et økosystem af identifikatorer. Et CVE-id (Common Vulnerabilities and Exposures), tildelt af en CVE Numbering Authority, navngiver en bestemt fejl i et bestemt produkt; et CWE (Common Weakness Enumeration) navngiver den underliggende defektklasse (fx CWE-79 cross-site scripting eller CWE-89 SQL-injektion), så mange CVE'er deler én CWE-grundårsag. Den amerikanske National Vulnerability Database (NVD) beriger CVE-poster, og siden maj 2025 driver ENISA den europæiske sårbarhedsdatabase (EUVD), oprettet under NIS2-direktivet, som en EU-vedligeholdt kilde, der krydsrefererer eksisterende databaser og markerer udnyttede poster.\n\nAlvor kommunikeres med Common Vulnerability Scoring System (CVSS), der giver en score fra 0 til 10 ud fra en vektor af metrikker. Basismetrikkerne (attack vector, attack complexity, privileges required, user interaction, scope samt påvirkning af fortrolighed, integritet og tilgængelighed) beskriver den iboende alvor; temporale og miljømæssige metrikker justerer for exploit-modenhed og det konkrete setup. CVSS v3.1 er fortsat udbredt, og v4.0 blev udgivet i 2023 for at imødegå kritik og tilføje finere granularitet. En afgørende nuance er, at CVSS måler teknisk alvor, ikke risiko: den fortæller ikke, hvor sandsynligt det er, at fejlen udnyttes i dit miljø, og derfor tilføjer prioritering i stigende grad EPSS (Exploit Prediction Scoring System, en sandsynlighed for, at et CVE udnyttes i praksis) og CISA's Known Exploited Vulnerabilities-katalog (KEV), der lister fejl med bekræftet aktiv udnyttelse og bør patches først uanset CVSS.\n\nSårbarheder findes gennem kodegennemgang, SAST og DAST, scanning af afhængigheder og containere (software composition analysis), penetrationstest og bug bounty-forskning. At håndtere dem godt betyder Coordinated Vulnerability Disclosure (ISO/IEC 29147 for at modtage rapporter og 30111 for at håndtere dem), hvor en forsker privat underretter leverandøren, en rettelse forberedes, og detaljer offentliggøres sammen med patchen; NIS2 artikel 12 etablerede et EU-rammeværk for koordineret offentliggørelse og CSIRT-rollen heri. Operationelt er sårbarhedshåndtering en løbende livscyklus - aktivinventar, scanning, prioritering, udbedring og verifikation - målt på metrikker som mean time to remediate.\n\nTo misforståelser går igen. For det første at en høj CVSS-score altid betyder hastende handling: en kritisk fejl uden kendt exploit og uden eksponering mod angribere kan rangere under en middel-fejl, der udnyttes i dag, og derfor bør udnyttelighed og eksponering - ikke alvor alene - drive god prioritering. For det andet at en sårbarhed udelukkende er en softwarefejl; fejlkonfiguration, svage processer og menneskelig modtagelighed (målet for social engineering) er også sårbarheder og ofte de mest udnyttede. En sårbarhed adskiller sig fra en trussel (den potentielle årsag til skade, der skal finde en svaghed at handle på) og fra et exploit (den konkrete teknik eller kode, der udnytter svagheden); en zero-day er ganske enkelt en sårbarhed, som der endnu ikke findes en patch til, når den først udnyttes."},"edges":[{"type":"requires","to":"security/threat","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments","tier":"standard","publisher":"NIST"},{"title":"European Vulnerability Database (EUVD)","url":"https://euvd.enisa.europa.eu/","tier":"official-doc","publisher":"ENISA"}],"draft":true}