CVSS Score

What Is a CVSS Score?

A CVSS score rates how severe a software or hardware security flaw is, on a scale running from 0.0 to 10.0. The letters stand for Common Vulnerability Scoring System, an open standard kept by the Forum of Incident Response and Security Teams. Each score arrives with a label attached: None, Low, Medium, High, or Critical.

Take a flaw in a web server that lets an attacker run commands without logging in first. Severity of that order tends to fall between 9.0 and 10.0, which puts it in the critical band.

Scanners, vendors, and public databases print the score beside each flaw they disclose. Every disclosed flaw also gets a CVE identifier, which acts as the catalog number tools use to name it.

How Does a CVSS Score Work?

A CVSS score comes from converting the technical traits of a flaw into fixed rating values and running those values through a published formula. Each trait answers one narrow question. Can the flaw be reached across a network? What breaks once the attack succeeds?

The standard assigns a weight to each answer. Those weights are combined into a single number, rounded to one decimal place. The standard is published in full, so two analysts holding the same facts should land on the same figure.

Most teams never run the formula themselves. Vulnerability management tools do the calculation and attach the result to every finding they report.

What Does a CVSS Vector String Look Like?

A CVSS vector string is a short line of text holding every metric value behind a score. Abbreviation pairs run one after another, split by slashes: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

One pair covers one metric and the value chosen for it. Read AV:N as an attack vector of Network, meaning remote access to the flaw is possible. PR:N marks privileges required as None, so the attacker needs no account.

The string travels with the score in security advisories, the notices a vendor publishes about a new flaw. A vulnerability assessment report prints it beside each finding, so a team can check how a rating was reached.

What Are the Metric Groups in CVSS?

CVSS metric groups are the categories of input that shape a score. Version 3.1 defines three groups. Version 4.0 keeps the same shape, renames one group, and adds a fourth.

1. Base metrics: Base metrics cover the fixed qualities of the flaw. The exploitability half covers the route to the flaw and the effort an attack demands. On the impact side, the question is what happens to data confidentiality, data accuracy, and service uptime.

2. Temporal metrics, renamed Threat metrics in version 4.0: Temporal metrics cover what shifts after disclosure, mainly whether working attack code exists and how widely it circulates. Log4Shell moved up the queue for most teams once that code spread publicly.

3. Environmental metrics: Environmental metrics let an organization adjust the base score for its own systems. A flaw on a test server behind a firewall can be scored down, and the same flaw on a payroll system can be scored up.

4. Supplemental metrics, added in version 4.0: Supplemental metrics record extra context that does not change the number, such as whether an attack can be automated at scale.

A score is named after the groups behind it. CVSS-B rests on Base metrics alone. Add Threat and it becomes CVSS-BT, add Environmental and it becomes CVSS-BE, and CVSS-BTE covers all three.

What Are the CVSS Severity Ratings?

CVSS severity ratings turn the number into a plain label that a non-specialist can act on.

• 0.0: None

• 0.1 to 3.9: Low

• 4.0 to 6.9: Medium

• 7.0 to 8.9: High

• 9.0 to 10.0: Critical

Many security policies attach fix deadlines to these bands. A Critical finding may carry a seven-day deadline, while a Medium finding gets a quarter.

What Are the Versions of CVSS?

CVSS versions are the editions the standard has moved through, each carrying its own formula. The dates run 2007 for version 2, 2015 for version 3.0, 2019 for version 3.1, and 2023 for version 4.0.

Numbers from one version cannot be compared against another, which is why an advisory names the version behind its score. Version 4.0 answers a long complaint about the earlier formula, which piled too many flaws into the High and Critical bands.

What Is the Difference Between CVSS and CVE?

CVSS and CVE cover the same flaw from two angles. The CVE side handles naming, while CVSS handles severity.

A CVE identifier takes the form CVE-2021-44228 and comes from a program the MITRE Corporation runs. Every vendor and scanner refers to one flaw by that single name.

A CVSS score is the severity figure attached to that catalog entry. The identifier stays fixed, while the score can be recalculated when new information arrives.

Who Assigns a CVSS Score?

CVSS scores are assigned by the organizations that disclose and catalog the flaw. Software vendors rate flaws in their own products at the point of disclosure.

The National Institute of Standards and Technology runs the National Vulnerability Database, which publishes base scores of its own. That figure is the one most security tools display.

Any team can also produce its own score with the public CVSS calculator. That helps when the published figure misses something specific about their setup.

Why Is a CVSS Score Important?

A CVSS score gives every party involved one published measure of severity to work from. Point a scanner, a vendor, and an auditor at the same number, and all three read it the same way.

Sorting findings by score holds attention on the flaws carrying the widest impact. Security frameworks also require documented severity ratings and set fix windows by band, so the score feeds IT risk management reporting.

What Are the Limitations of a CVSS Score?

A CVSS base score measures the technical severity of a flaw in isolation. It has no view of where the affected system stands in your environment or what data it holds.

A high base score can attach to a flaw nobody has ever attacked, and a moderate score can attach to one under active exploitation. A zero-day vulnerability may carry no score for a while, because rating follows public disclosure.

Teams close these gaps by reading the score alongside exploit intelligence and asset value. Cyber threat intelligence tells you what attackers are using now. Asset records tell you what the flaw would cost.

How Are CVSS Scores Used in Vulnerability Management?

CVSS scores are used in vulnerability management as the first sort order for a long list of findings. Hundreds of items can come back from one scan, each tagged with an identifier and a score.

Filters then narrow the list by active exploitation, business criticality, and internet exposure, leaving a handful of items at the top of the queue.

From there the work moves into vulnerability remediation, which means a patch, a configuration change, or a documented workaround. The score stands as the record of why that item was handled first.