CVSS (Common Vulnerability Scoring System) is a common yardstick that rates the severity of software and hardware vulnerabilities from 0.0 to 10.0. Choose the eight base metrics and the tool computes the base score with the formula from the specification.
Favorites and recently used calculators are stored only in this browser (localStorage).
Results
Base score
–
Severity
–
Impact sub-score
–
Exploitability sub-score
–
Vector string:
Only the base score is computed, using the formula in FIRST's CVSS v3.1 specification. Temporal and Environmental scores and CVSS v4.0 (published in November 2023) are not supported.
See it as a graph
Other inputs stay at their current values while the chosen input varies from 1/4 to 4 times its current value. The red dot is the current value.
What is CVSS?
CVSS (Common Vulnerability Scoring System), maintained by FIRST, is a common method for rating vulnerability severity. So that different products and vendors can be compared on the same scale, it turns how easy an attack is and what a successful attack would do into a number from 0.0 to 10.0 using fixed metrics. Databases such as NVD and JVN publish a base score and vector string for each CVE, and these are used to prioritise fixes.
The eight base metrics
Four metrics describe how easy an attack is: Attack Vector (Network, Adjacent, Local, Physical), Attack Complexity, Privileges Required and User Interaction. Three describe the impact on Confidentiality, Integrity and Availability (High, Low, None). Scope says whether the impact reaches beyond the vulnerable component, for example from a browser to the OS or from a virtual machine to the host. In the "Log4Shell" example the attack is over the network, needs no authentication, changes scope and has high impact everywhere, so it reaches the maximum of 10.0.
How the score is calculated
First the three impacts give ISS = 1 − (1 − C)(1 − I)(1 − A). With scope unchanged, Impact = 6.42 × ISS; with scope changed, Impact = 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)^15. Exploitability = 8.22 × AV × AC × PR × UI. If Impact is 0 or less the base score is 0; otherwise the sum of Impact and Exploitability (multiplied by 1.08 when scope changes) is capped at 10 and rounded up to one decimal place. The Privileges Required weights are larger only when scope changes.
What the base score does not tell you
The base score reflects only the intrinsic properties of the vulnerability. It does not include whether it is being actively exploited or how important the affected system is to you: the Temporal score adjusts for things like exploit availability, and the Environmental score for your own environment. A high score may be less urgent on a device that is not network-connected. Treat the base score as the starting point for prioritisation and combine it with asset value and real-world threat information.
ACVE is a common identifier assigned to each vulnerability, and CVSS is a common method that rates the severity of a vulnerability with a number from 0.0 to 10.0
BCVE is a number that rates the severity of a vulnerability, and CVSS is a vulnerability identifier
CBoth CVE and CVSS are names of definition files that antivirus software uses to recognize malware
Show answer and explanation
Answer: A. CVE is a common identifier assigned to each vulnerability, and CVSS is a common method that rates the severity of a vulnerability with a number from 0.0 to 10.0
CVE (Common Vulnerabilities and Exposures) is an identifier of the form "CVE-year-number" assigned to each publicly disclosed vulnerability, so that the same vulnerability can be referred to by the same number across products and organizations. CVSS (Common Vulnerability Scoring System) is a common method that rates the severity of a vulnerability with a number from 0.0 to 10.0, based on factors such as the conditions needed for an attack and the impact on confidentiality, integrity and availability. The CVSS base score reflects the nature of the vulnerability itself, so the order in which fixes are applied is decided by also considering how dangerous it actually is in one's own environment (for example, whether the device is reachable from the internet, or whether attacks have actually been observed). Vulnerability management repeats a cycle: keeping an inventory of the software and versions in use (an asset register), gathering information on new vulnerabilities, assessing their impact, applying patches and confirming that they were applied.
AAn attack carried out only on the day the software is installed
BAn attack that targets only old vulnerabilities for which fixes were released many years ago
CAn attack that exploits a software vulnerability after it is discovered but before the vendor provides a fix (or before the fix is widely applied)
Show answer and explanation
Answer: C. An attack that exploits a software vulnerability after it is discovered but before the vendor provides a fix (or before the fix is widely applied)
A zero-day attack exploits a vulnerability while the vendor does not yet know about it, or knows but has not yet provided a fix (patch). Counting the day the fix is released as day one, the attack happens before it, on "day zero," hence the name. Since no patch can be applied, it is important to stack other measures to limit the damage, for example disabling unneeded services to reduce the attack surface, minimizing privileges, segmenting the network, using mechanisms that detect and respond to suspicious activity on endpoints (such as EDR), and applying workarounds published by the vendor. Once a fix is provided, it should be applied as soon as possible.
FAQ
What are the severity ranges?
In CVSS v3.1, 0.0 is None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High and 9.0–10.0 Critical.
What does "Scope: Changed" mean?
It applies when the impact crosses into a different security authority from the vulnerable component, for example XSS, where a web application flaw runs script in the user's browser, or a flaw that lets a virtual machine affect the host. With scope changed, the same impacts give a higher base score.
How does CVSS v4.0 differ?
FIRST published CVSS v4.0 in November 2023. It adds Attack Requirements (AT), removes Scope and rates the impact on the vulnerable system and on other systems separately, among other changes. v3.1 and v4.0 scores are not directly comparable, so check which version a score uses.
How does CVSS relate to CVE and NVD?
A CVE is the identifier given to each vulnerability, and CVSS is the number expressing its severity. Databases such as the US NVD and Japan's JVN publish CVSS scores and vector strings for each CVE. The same vulnerability can receive different scores from different organisations.