← Glossary

Scoring & Metrics

CVSS (Common Vulnerability Scoring System)

Also: Common Vulnerability Scoring System · CVSS v3.1 · CVSS v4.0 · CVSS vector · base score · CVSS 9.8

In one sentence

CVSS is the industry formula that turns the intrinsic characteristics of a vulnerability — how it is reached, how hard it is, what it breaks — into a 0–10 severity score and a vector string that records how the score was derived.

Why it matters

Every CVE arrives with a CVSS score, every scanner sorts by it, and every SLA ("criticals within 7 days") is written against it. Understanding what the number means — and what it does not — is the difference between patching what matters and patching what is loud. The base score measures severity if exploited, deliberately ignoring whether anyone is exploiting it and whether the affected asset matters to you. Those two facts are what EPSS and the Environmental metrics add, and why "CVSS 9.8" on its own is a bad reason to wake anyone up.

How a score is built

v3.1 (2019, still the most common) has three metric groups. The Base group is scored by the vendor or NVD: exploitability — Attack Vector (Network / Adjacent / Local / Physical), Attack Complexity (Low / High), Privileges Required (None / Low / High), User Interaction (None / Required) — plus Scope (Unchanged / Changed: does the exploit cross a security boundary?) and impact on Confidentiality, Integrity and Availability (None / Low / High). The Temporal group adjusts for exploit code maturity, remediation level and report confidence; the Environmental group lets you re-weight C/I/A for the asset and override base metrics for your deployment.

The output is a score in five bands — None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0 — and a vector that records every choice: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is the famous 9.8 (remote, easy, unauthenticated, full compromise, one component). Change Scope to S:C and it becomes 10.0 — Log4Shell's vector.

v4.0 (November 2023) keeps the idea and fixes the complaints. Scope is gone, replaced by separate impact metrics for the vulnerable system and any subsequent system (VC/VI/VA and SC/SI/SA). Attack Complexity is split from a new Attack Requirements metric (conditions that must exist, such as a race to win). User Interaction gains a Passive value. Temporal becomes Threat (one metric: Exploit Maturity), and the nomenclature says which groups were used — CVSS-B base only, CVSS-BT with threat, CVSS-BE, CVSS-BTE. A new Supplemental group (Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort, Provider Urgency) carries context without changing the score. Scores are no longer computed by a formula but looked up from expert-ranked equivalence classes, so v3.1 and v4.0 numbers are not directly comparable.

Try it yourself hands-on

A scanner reports a "Critical 9.8" SQL injection in an internal HR application that is only reachable from the office network by logged-in staff. Is it a 7-day SLA item?

  1. Rebuild the base score in the CVSS v3.1 Calculator: AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H → 9.8 Critical. That is the vendor's view of the software in the abstract.
  2. Now the Environmental group, which is your view: the application is on an internal segment, so set Modified Attack Vector to Adjacent; it requires a staff login, so Modified Privileges Required Low; HR data makes Confidentiality Requirement High but Availability Requirement Low. The calculator recomputes: the environmental score lands in the High band, around 7.x, and the vector now carries /MAV:A/MPR:L/CR:H/AR:L so the reasoning is auditable.
  3. Score the same finding in the CVSS v4.0 Calculator to see the change of model: with no exploit known, Exploit Maturity Unreported pulls the CVSS-BT score down further, and the Supplemental Automatable: No is a fact the ticket can carry.
  4. Add the exploitation view: look the CVE up in the EPSS Score Lookup. A low probability with no KEV listing, plus the environmental result, supports a 30-day fix rather than a 7-day one — and the SSVC Decision Tree walks you to the same conclusion in vocabulary a change-advisory board understands (Track, not Act).

The base score was never wrong. It was answering a different question.

Common misreadings

  • Severity is not risk. CVSS measures how bad exploitation would be, not how likely it is (EPSS, KEV) or how much the asset matters (Environmental).
  • Vendor and NVD scores differ. Both are legitimate base scores made with different assumptions; the vector tells you which assumptions.
  • Rounding is defined. v3.1 rounds up to one decimal (a 4.02 is 4.1, a 6.94 is 7.0 — which crosses a band). A calculator that uses ordinary rounding is wrong; this site's had exactly that bug once and now has a test for it.