> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/vulnerability-classification/cvss.md).

# CVSS

CVSS (Common Vulnerability Scoring System) is a standardised system used to **measure the severity of security vulnerabilities**. It gives a **numeric score** that helps organisations prioritise which vulnerabilities to fix first.

***

#### **CVSS Scores**

* **Range:** 0.0 to 10.0

| CVSS Version | Severity | Score Range |
| ------------ | -------- | ----------- |
| v2.0         | Low      | 0.0–3.9     |
|              | Medium   | 4.0–6.9     |
|              | High     | 7.0–10.0    |
| v3.x / v4.0  | Low      | 0.1–3.9     |
|              | Medium   | 4.0–6.9     |
|              | High     | 7.0–8.9     |
|              | Critical | 9.0–10.0    |

***

#### **CVSS Metrics**

CVSS score is calculated from **three metric groups**:

1. **Base Metrics** – Core characteristics of the vulnerability (constant over time).
   * **Exploitability:** How easy it is to exploit (e.g., network access, authentication required).
   * **Impact:** Effect on confidentiality, integrity, and availability if exploited.
2. **Temporal Metrics** – Factors that can change over time.
   * Availability of exploit code, fixes, or mitigations.
3. **Environmental Metrics** – Context-specific factors for your organisation.
   * How critical is the vulnerable system in your environment.
   * May adjust the score higher or lower depending on business impact.

***

#### Understand the CVSS Metric Groups

CVSS has **three metric groups**:

1. **Base Metrics (mandatory)** – Core characteristics of the vulnerability.
   * **Exploitability Metrics:**
     * Attack Vector (AV): Network, Adjacent, Local, Physical
     * Attack Complexity (AC): Low, High
     * Privileges Required (PR): None, Low, High
     * User Interaction (UI): None, Required
   * **Impact Metrics:**
     * Confidentiality (C): None, Low, High
     * Integrity (I): None, Low, High
     * Availability (A): None, Low, High
2. **Temporal Metrics (optional)** – Change over time.
   * Exploit Code Maturity (E)
   * Remediation Level (RL)
   * Report Confidence (RC)
3. **Environmental Metrics (optional)** – Your environment’s context.
   * Modified Base Metrics for your organisation
   * Security Requirements (CR, IR, AR)

***

#### Calculating Websites

* <https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator>
* <https://www.first.org/cvss/calculator/3-1is&#x20>;