CVSS (Common Vulnerability Scoring System)

CVSS (Common Vulnerability Scoring System) is a standard method for describing the severity of a vulnerability. It produces a score from 0.0 to 10.0 and a vector string recording the metrics behind it. The standard is maintained by FIRST.

Why it matters

A shared scale lets organisations compare and prioritise thousands of flaws. Base metrics describe the vulnerability itself, such as attack vector, complexity, privileges required, user interaction and the impact on confidentiality, integrity and availability. Common qualitative bands are None, Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9) and Critical (9.0-10.0).

Example

A vector string looks like this:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

It describes a network-reachable, low-complexity flaw needing no privileges or user interaction, with high impact on all three properties. That combination scores 9.8, which is Critical.

Common mistakes

• Treating the base score as risk. It ignores whether the system is exposed or the flaw is being exploited.
• Ignoring environmental context, such as whether the vulnerable component is internet-facing.
• Mixing versions of the standard, since 3.1 and 4.0 scores differ.
• Patching only by score and overlooking low scores that chain together.

Related

• CVE
• Vulnerability
• Patch management
• Remote code execution

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.