Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Understanding severity levels for your Amazon Inspector findings

When Amazon Inspector generates a finding, it assigns a severity rating to the finding. Severity ratings help you assess and prioritize your findings. The severity rating for a finding corresponds to a numerical score and level: informational, low, medium, high, and critical. Amazon Inspector determines the severity rating for a finding based on the finding type. This section describes how Amazon Inspector determines a severity rating for each finding type.

Software package vulnerability severity

Amazon Inspector uses the NVD/CVSS score as the basis of severity scoring for software package vulnerabilities. The NVD/CVSS score is the vulnerability severity score published by the NVD and defined by the CVSS. The NVD/CVSS score is a composition of security metrics, such as attack complexity, exploit code maturity, and privileges required. Amazon Inspector produces a numerical score from 1 to 10 that reflects the vulnerability’s severity. Amazon Inspector categorizes this as a base score because it reflects the severity of a vulnerability according to its intrinsic characteristics, which are constant over time. This score also assumes the reasonable worst-case impact across different deployed environments. The CVSS v3 standard maps CVSS scores to the following severity ratings.

Package vulnerability findings can also have a severity of Untriaged. This means that the vendor hasn't yet set a vulnerability score for the detected vulnerability. In this case, we recommend using the reference URLs for the finding to research that vulnerability and respond accordingly.

Package vulnerability findings include the following scores and associated scoring vectors as part of their finding details:

Code vulnerability severity

For code vulnerability findings Amazon Inspector uses the severity levels defined by the Amazon CodeGuru detectors that generated the finding. Each detector is assigned a severity using the CVSS v3 scoring system. For an explanation of the severities CodeGuru uses see Severity definitions in the CodeGuru guide. For a list of detectors by severity, select from the supported programming languages below:

Network reachability severity

Amazon Inspector determines the severity for a network reachability vulnerability based on the service, ports, and protocols that are exposed and by the type of open path. The following table defines these severity ratings. The value in the Open path rating column represents open paths from virtual gateways, peered VPCs, and Amazon Direct Connect networks. All other exposed services, ports, and protocols have an Informational severity rating.