What a CVSS base score is
The Common Vulnerability Scoring System, maintained by FIRST, turns the characteristics of a vulnerability into a number from 0.0 to 10.0. Version 3.1 has three metric groups. The base group, which this CVSS calculator scores, describes what does not change over time or between environments: how the flaw is reached, what the attacker needs first, and what it does to confidentiality, integrity and availability. The temporal and environmental groups adjust that number for exploit maturity and for one organization’s own systems, and both are optional.
The eight base metrics
- Attack Vector (AV)
- How far away the attacker can be: across the network, on an adjacent network, local to the system, or with physical access.
- Attack Complexity (AC)
- Whether success depends on conditions outside the attacker’s control, such as a race or a non-default configuration.
- Privileges Required (PR)
- The level of access the attacker must already hold: none, a basic account, or administrative control.
- User Interaction (UI)
- Whether someone other than the attacker has to take part, for example by opening a link.
- Scope (S)
- Whether the flaw reaches resources beyond the security authority of the vulnerable component. Leaving a sandbox or a guest machine is a changed scope.
- Confidentiality (C), Integrity (I) and Availability (A)
- The loss in each for the affected component: none, low or high.
How to read the result
The specification maps scores to five severity ratings: 0.0 is None, 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High and 9.0 to 10.0 Critical. A base score states severity, not risk. The same 9.8 means something different on an isolated lab host than on a system the whole internet can reach, which is what the environmental metrics and your own judgement are for.
In a report, give the vector beside the score so a reader can check how you got there. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reads as network reachable, low complexity, no privileges, no user interaction, unchanged scope and high impact on all three properties, and scores 9.8. Paste a vector into the field above and the controls follow it. The page address carries the current vector, so a link from a finding or a ticket opens the calculator on the same score.
How the score is calculated
The calculator follows section 7.1 of the CVSS v3.1 specification. An impact sub-score comes from the confidentiality, integrity and availability values, and an exploitability sub-score from the other four. The two are added, multiplied by 1.08 when scope is changed, capped at 10 and rounded up to one decimal place. A finding with no impact scores 0.0 whatever its exploitability. Privileges Required carries a different weight when scope is changed, so the same answer to it can give two different scores.