VMC: An open-source vulnerability management center for asset-aware, CVSS-driven prioritization

The Vulnerability Management Center (VMC) is an open-source platform for asset-aware vulnerability prioritization driven by the Common Vulnerability Scoring System (CVSS) in heterogeneous corporate networks. VMC ingests scan reports from multiple scanners (Nessus, OpenVAS), matches findings with the asset inventory of the organization, enriches them with Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE) and exploit metadata from the National Vulnerability Database (NVD), and recomputes CVSS v2 and v3 environmental scores asynchronously whenever an input changes. A Celery-based pipeline writes results into Elasticsearch and exposes them through dashboards, a Representational State Transfer (REST) application programming interface (API) and TheHive webhooks, so that the Security Operations Center (SOC) can consume them in remediation workflows. The platform implements the CVSS v2 and v3.x environmental specifications; CVSS v4.0 support is on the project roadmap. VMC is container-deployable and has underpinned several of the authors’ peer-reviewed studies on vulnerability prioritization; this paper is the first dedicated software description of the artifact.