A CVSS score, or Common Vulnerability Scoring System score, is a standardized numerical value (ranging from 0 to 10) used to assess and communicate the severity of security vulnerabilities in software and systems. The higher the score, the more severe the vulnerability, helping organizations prioritize which issues to address first.
How CVSS Scores Work
CVSS provides a consistent way to evaluate vulnerabilities across different platforms and vendors. It does this by considering several factors, grouped into metrics, to generate a score:
- Base Metrics: Measure the inherent qualities of a vulnerability (e.g., how easy it is to exploit, what privileges are required, whether user interaction is needed, and the potential impact on confidentiality, integrity, and availability).
- Temporal Metrics: Adjust the score based on factors that can change over time, such as the availability of patches or exploit code.
- Environmental Metrics: Allow organizations to tailor the score to their specific environment, reflecting how the vulnerability could affect their unique systems and business context.
CVSS Score Ranges and Severity Levels
| CVSS Score | Severity Level |
|---|---|
| 0.0 | None |
| 0.1–3.9 | Low |
| 4.0–6.9 | Medium |
| 7.0–8.9 | High |
| 9.0–10.0 | Critical |
What Factors Influence the Score?
Key elements that affect a CVSS score include:
- Attack Vector: How the vulnerability can be exploited (e.g., over a network vs. physical access).
- Attack Complexity: How difficult it is to exploit the vulnerability.
- Privileges Required: The level of access an attacker needs before exploiting the vulnerability.
- User Interaction: Whether a user must participate for the exploit to succeed.
- Scope: Whether the vulnerability can affect components beyond its initial target.
- Impact on Confidentiality, Integrity, and Availability: The potential damage to data and systems if exploited.
Limitations
A CVSS score measures severity, not risk. It does not account for how likely a vulnerability is to be exploited in the wild or the specific context of an organization’s IT environment. Also, scores may not be updated quickly as new information emerges, and not all vulnerabilities are immediately scored