CVSS (Common Vulnerability Scoring System)

CVSS (Common Vulnerability Scoring System) is a standard method for describing the severity of a vulnerability. It produces a score from 0.0 to 10.0 and a vector string recording the metrics behind it. The standard is maintained by FIRST.

Why it matters

A shared scale lets organisations compare and prioritise thousands of flaws. Base metrics describe the vulnerability itself, such as attack vector, complexity, privileges required, user interaction and the impact on confidentiality, integrity and availability. Common qualitative bands are None, Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9) and Critical (9.0-10.0).

Example

A vector string looks like this:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

It describes a network-reachable, low-complexity flaw needing no privileges or user interaction, with high impact on all three properties. That combination scores 9.8, which is Critical.

Common mistakes

• Treating the base score as risk. It ignores whether the system is exposed or the flaw is being exploited.
• Ignoring environmental context, such as whether the vulnerable component is internet-facing.
• Mixing versions of the standard, since 3.1 and 4.0 scores differ.
• Patching only by score and overlooking low scores that chain together.

Related

• CVE
• Vulnerability
• Patch management
• Remote code execution

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.