Calculate CVSS Scores
The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. It is owned and managed by FIRST.Org and provides a numerical score from 0.0 to 10.0, plus a vector string that describes how the score was derived.
Scoring rules
- Score the vulnerability in isolation — Do not consider chaining with other vulnerabilities when assessing CIA (Confidentiality, Integrity, Availability) impact. Keep the score specific to the vulnerability in question.
- Assume detailed knowledge — The attacker already knows the target’s configuration and defenses (per CVSS v3.1 specification).
- Use the official calculator — The NVD and FIRST both provide interactive calculators that implement the exact equations.
Metric groups
| Group | Description |
|---|---|
| Base | Intrinsic qualities: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, CIA Impact |
| Temporal | Time-dependent: Exploit Code Maturity, Remediation Level, Report Confidence |
| Environmental | Organization-specific: CIA Requirements, Modified Base Metrics |
Vector string format
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
This example yields a 9.8 Critical score.
Tools
Related: vulnerability (assessment concepts), the NVD (CVE database), mitre-attack-emulation-plans (adversary emulation).
Sources
- Common Vulnerability Scoring System v3.1: Specification Document
- CVSS v3.1 Calculator — FIRST.org
- NVD — CVSS v3 Calculator
See also
- vulnerability
- the NVD
- mitre-attack-emulation-plans