Common Vulnerability Scoring System (CVSS).

What is the Common Vulnerability Scoring System?

The Common Vulnerability Scoring System (CVSS) is a standard way to describe how severe a software vulnerability is. FIRST, the body that publishes it, says CVSS captures the main characteristics of a vulnerability and produces a numerical score that reflects its severity. A vulnerability is a weakness in software that an attacker may be able to abuse.

How does CVSS work?

FIRST describes CVSS version 4.0 as having four groups of metrics. A metric is one measured property of the vulnerability.

• Base: the intrinsic characteristics of the vulnerability, which stay constant across environments.
• Threat: characteristics of the vulnerability related to threat that may change over time.
• Environmental: characteristics of the vulnerability that are relevant and unique to a particular consumer’s environment.
• Supplemental: metrics that provide context and describe additional extrinsic attributes.

The specification says the Base score reflects the severity of a vulnerability according to its intrinsic characteristics, which are constant over time. It also says the Base score assumes the reasonable worst-case impact across different deployed environments. The score runs from 0.0 to 10.0.

What do the severity ratings mean?

FIRST says a numerical score can be translated into a qualitative rating such as low, medium, high or critical. This helps organizations assess and prioritize their vulnerability management work. The specification adds that a textual representation of the numeric scores is useful for some purposes. Check the FIRST specification for the exact score range behind each rating.

How should a CVSS score be labeled?

The specification gives labels that show which metrics were used. CVSS-B means Base metrics only. CVSS-BT means Base and Threat. CVSS-BE means Base and Environmental. CVSS-BTE means all three groups. The specification says this naming should be used wherever a numerical CVSS value is shown or shared, so a reader knows what the number includes.

How can teams use CVSS?

As a simple illustration, a team with a long list of vulnerabilities can sort it by rating to decide what to look at first. FIRST says the Environmental metrics and its Consumer Implementation Guide help tailor scores to unique deployment environments. FIRST also publishes a User Guide, a Specification Document, Examples and an FAQ.

Is CVSS the same as risk?

No. The specification says consumers may use CVSS information as input to an organizational vulnerability management process that also considers factors that are not part of CVSS. A score is therefore one input and not the full picture of risk.

Is a CVSS score the same as the base score?

Not always. The base score is one part of the system. A CVSS score can also include Threat and Environmental metrics, and the labels above show which were used.

Which versions of CVSS exist?

FIRST lists version 4.0 as current. Versions 3.1, 3.0, 2 and 1 are archived on its site. When comparing scores, check which version produced them.

Related terms are vulnerability management and patch management.

See also

• Vulnerability intelligence