Classification of Findings or Misconfiguration with something relatable like an hypothetical CVSS Score

[Schurik97]

Classification of Findings or Misconfiguration with something relatable like an hypothetical CVSS Score.

This would help to explain why this finding could lead to an exposure of credentials.

Might be an idea, if its to generic it can be closed.

[silverhack]

Hi @Schurik97 Thanks for the suggestion, it's really appreciated.

The CIS Benchmarks do not assign severity levels or CVSS scores to their controls, since they focus on configuration guidance rather than risk scoring. Having said that, I agree that adding an optional CVSS field could be useful for users who want to apply their own risk scoring model without modifying the benchmark.

One thing to keep in mind is that align Monkey365 rules with CVSS isn’t always straightforward. CVSS really depends on context, Exploitation, impacts, which other controls are in place, etc... Monkey365 rules don't always have that full picture and because of that, any CVSS score won't be a true reflection of the risk.

I’ll consider this as a potential enhancement.

Thanks!