vapt · beginner
Research CVE records, affected products, severity, references, and remediation without exploitation.
Login required to start this lab and save your progress.
Section 1 · 1 tasks
CVE means Common Vulnerabilities and Exposures. A CVE identifier such as CVE-2024-12345 gives a publicly disclosed vulnerability a stable name. The CVE is the identifier and record; the vulnerability is the underlying weakness.
Teams can use one CVE ID to compare scanner findings, vendor advisories, and patch notes without relying on inconsistent vulnerability names.
Section 2 · 2 tasks
A useful record includes its ID, description, affected products and versions, references, vendor advisory, weakness type, and severity information. CVSS summarizes technical severity; it does not replace asset context or risk analysis.
CVE-2025-42424 affects Acme Note Server 3.2.0 through 3.2.4. A path-validation flaw can expose files to an authenticated low-privilege user. CVSS is 7.5 High. The vendor advisory is ADV-2025-17.
Section 3 · 1 tasks
A matching product name alone is insufficient; version, configuration, and vendor guidance matter.
Section 4 · 2 tasks
Inventory shows Acme Note Server 3.2.3. The fictional CVE record reports CVE-2025-42424, path validation, versions 3.2.0–3.2.4, CVSS 7.5 High, and vendor fixed version 3.2.5.
Do not exploit the system. Compare inventory to the affected range, document the match, and follow the advisory.
