Vulnerability Management Tool: CVE Prioritizer | Black Hat Ethical Hacking

Installation

GitHub

git clone https://github.com/TURROKS/CVE_Prioritizer.git

cd CVE_Prioritizer

pip install -r requirements.txt

pip

pip install --user cve_prioritizer

 

Usage

To use CVE_Prioritizer effectively, follow these steps:

Request your API keys to avoid public rate limits:

• NIST NVD: Request here
• VULNCHECK (Fast): Register here.
• Save APIs: Use the -sa or –set-api option to save your API Keys in your .env file.

Select your CVE Data source:

• NIST NVD: Default.
• NVD++: Use -vc or –vulncheck.
• VulnCheck KEV: Use -vck or vulnchek_kev (ONLY WORKS WITH NVD++).

Choose Input Method:

• Single CVE: Use the -c followed by the CVE ID.
• List of CVEs: Use -l followed by a comma-separated list of CVEs.
• File with CVEs: Use -f to import a file containing CVE IDs (one per line).
  • Import Vulnerability Reports: Use the -f flag along with –nessus or –openvas to automatically ingest CVEs from Nessus or OpenVAS scan reports.

Tailor the output according to your needs:

• Use the -v or –verbose for detailed information.
• Define custom thresholds with –cvss and/or –epss to align the results with your organization’s risk appetite.
• Define the number of concurrent threads with -t or –threads (default: 100).

 

Examples

Single CVE

python3 cve_prioritizer.py -c CVE-2020-29127

List of CVEs

python3 cve_prioritizer.py -l CVE-2020-29127,CVE-2017-16885

File with CVEs

You can also provide a text file with a list of CVEs (one per line)

python3 cve_prioritizer.py -f ~\Desktop\CheckTheseCVEs.txt

 

Outputs

CVE_Prioritizer provides flexible output options to suit your preferences. By default, it provides a summary of results, including the CVE-ID and its priority. However, you can enable verbose mode to obtain additional information.

Here are the available output options:

Summary Results (default): Provides a concise summary, including the CVE-ID and its priority.

Verbose Mode: Enables detailed output with the following information for each CVE:

• CVE ID
• Priority
• EPSS Score
• CVSS Base Score
• CVSS Version
• CVSS Severity
• KEV Status (TRUE or FALSE)
• Vendor
• Product
• CVSS Vector

 

CSV File

You can save the results to a CSV file by using the -o or –output flags

python3 cve_prioritizer.py -f cve_list.txt -o ~/Desktop/prioritized.csv

This outputs the verbose results independently of the terminal output that you use.