EPSS score integration

[ciscocollabguru]

Question

I'm wondering if there is the ability to utilize EPSS scores along with (or in lieu of) only CVSS? Or if there are plans to begin to include these scores into the project?

Target

None

Scanner

Vulnerability

Output Format

None

Mode

None

Operating System

No response

Version

No response

[simar7]

Do you have more info on what the EPSS score is and who publishes them?

[ciscocollabguru]

You bet! It was created by the same group that came up with CVSS to address the deficiencies of that scoring system. LunaSec has a good write-up on what it is (first link). FIRST has a public API to access the scores and it’s updated daily I believe (second link).

https://www.lunasec.io/docs/blog/what-is-epss/
https://www.first.org/epss/api

[synack-security]

This would be great to include in the output of a scan. Example query:
https://api.first.org/data/v1/epss?cve=CVE-2022-27225,CVE-2022-27223,CVE-2022-27218

[jthin]

Hello,

As discussed this morning at Kubecon EU with @simar7, we need EPSS score with CVE score. It helps to review CVE score with another (security) perspective.
Qualys has this information: more information

cc: @AnaisUrlichs

[jthin]

Thank you for your response. Is there any plan to integrate it also for the open source version?

[knqyf263]

We currently have no plans to integrate EPSS into the OSS. More requests may change the plan, but we can't promise.

[EdgewareRoad]

As not in the OSS version of Trivy, my Trivy Summary tool (essentially a reporting tool and optimised for CI) now also includes EPSS, if that helps. https://github.com/EdgewareRoad/TrivySummary

[itaysk]

@EdgewareRoad thanks for sharing. would you want to add it to the trivy documentation under "ecosystem" section? feel free to open a pr. also, this might be a good case for a Trivy output plugin

[EdgewareRoad]

@itaysk Thanks for the suggestion. I'll take a look.

[itaysk]

Summarizing this thread for the record: We will not implement EPSS scoring natively in Trivy as we consider it out of scope of the Trivy project. The scope and other core principles are documented here. Specifically, EPSS falls under "Exploitability of the vulnerability" as mentioned here.