Retrieving CVSS Scores for multiple CVEs can be a redundant task. Fortunately, Python can be leveraged to provide an easy way to convert CVE-ID to CVSS 3 or CVSS 2 Scores. In this post, I will show you how to use Python3 to create a simple script to pull the latest CVSS base score from the NIST National Vulnerability Database (NVD). The output of the script can be easily copied and paste into an excel file and separated with text to column.
Python package requirements:
Import the Python packages
Setup system arguments to read the target file
The above code snippet will ensure that the python script only runs when an argument is specified. After a target file is specified as an argument, the script will attempt to read the CVE-ID line by line within the text file.
Use the BeautifulSoup package to perform bulk CVE lookup
In this portion of the script, the script will check the BeautifulSoup web request to see if a CVSS 2 score is available. If the CVSS 2 score is not available, the script will display N/A for the output.
Prepare the cve.txt file
The text file containing the CVEs should have the CVE-ID separated line by line as shown above.
You need Python3 to run the script.
If the python script and cve.txt are in the same directory, you can run the following command:
$ python3 bulk_cve_lookup.py cve.txt