What is a CVSS score?

CVSS, the Common Vulnerability Scoring System, rates the technical severity of a vulnerability from 0.0 to 10.0, computed from a short vector of metrics such as attack vector and privileges required. It is maintained by FIRST; version 4.0 is current, and many records still carry version 3.1 scores.

Why it matters

A score turns a long advisory into a number you can sort by, and the vector behind it says why the number is what it is. FIRST's specification maps scores to qualitative ratings: 0.1 to 3.9 low, 4.0 to 6.9 medium, 7.0 to 8.9 high and 9.0 to 10.0 critical, with 0.0 meaning none.

The base score describes the flaw in general, not in your deployment. FIRST says so directly: CVSS measures severity, not risk. A 9.8 in a library feature you never call can matter less to you than a 6.5 on your login page. CVSS 4.0 adds threat and environmental metrics so you can adjust the score for exploitation evidence and for your own setup.

Example: reading a CVSS 3.1 vector

A vulnerability record carries a vector string next to the score. This one is the classic 9.8 critical, common for remotely reachable memory-corruption and injection bugs:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H   -> 9.8 Critical

AV:N  attack vector: network (reachable remotely)
AC:L  attack complexity: low
PR:N  privileges required: none (no login)
UI:N  user interaction: none
S:U   scope: unchanged
C:H I:H A:H  high impact on confidentiality, integrity and availability

Now apply it to your own site. If the vulnerable component sits behind a login on your deployment, PR:N is not true for you; if the feature is switched off, the bug is not reachable at all. That is the reasoning the environmental metrics capture. Our vulnerability briefs show both: the severity each source published, and the checks to run on your own systems to see whether the conditions in the vector hold.

Common mistakes

  • Treating the score as risk. CVSS is severity in general. Your exposure, the data at stake and active exploitation decide priority.
  • Comparing a 3.1 score with a 4.0 score. The versions use different metrics and formulas. Compare like with like, and quote the version.
  • Quoting one source's number as fact. The vendor and the NVD sometimes score the same CVE differently. Say whose score it is.
  • Ignoring medium scores. Several mediums chained together, or one on an exposed endpoint, can matter more than a distant critical.

Related terms

Go deeper

Sources

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.