Score a vulnerability, decode a vector string, and learn what every metric means for Security+, CySA+, PenTest+ and CEH.
The vulnerability itself. Constant over time and across environments.
How close does the attacker need to be?
Network: Exploitable remotely across the internet or a routed network, for example an exposed web server.
Does the attack depend on conditions outside the attacker's control?
Low: No special conditions. The attack works reliably every time.
What account level must the attacker already have?
None: No login needed. Unauthenticated attack.
Does a victim have to do something?
None: No victim action needed. Typical of wormable bugs.
Can the impact spread beyond the vulnerable component's security authority?
Unchanged: Impact stays inside the vulnerable component, for example a bug in an app that only affects that app.
How much data can the attacker read?
None: No loss of confidentiality on the impacted component.
How much data can the attacker change?
None: No loss of integrity on the impacted component.
How badly can the attacker disrupt the service?
None: No loss of availability on the impacted component.
How mature is exploit code for this vulnerability?
Not Defined: Not set. The calculator uses the worst case (High).
Is a fix available?
Not Defined: Not set. The calculator uses the worst case (Unavailable).
How confident are we that the vulnerability is real?
Not Defined: Not set. The calculator uses the worst case (Confirmed).
How important is confidentiality of this asset to your organisation?
Not Defined: Not set. The calculator uses Medium (no adjustment).
How important is integrity of this asset to your organisation?
Not Defined: Not set. The calculator uses Medium (no adjustment).
How important is availability of this asset to your organisation?
Not Defined: Not set. The calculator uses Medium (no adjustment).
In your environment: how close does the attacker need to be?
Not Defined: Not set. The calculator uses the Base value.
In your environment: does the attack depend on conditions outside the attacker's control?
Not Defined: Not set. The calculator uses the Base value.
In your environment: what account level must the attacker already have?
Not Defined: Not set. The calculator uses the Base value.
In your environment: does a victim have to do something?
Not Defined: Not set. The calculator uses the Base value.
In your environment: can the impact spread beyond the vulnerable component's security authority?
Not Defined: Not set. The calculator uses the Base value.
In your environment: how much data can the attacker read?
Not Defined: Not set. The calculator uses the Base value.
In your environment: how much data can the attacker change?
Not Defined: Not set. The calculator uses the Base value.
In your environment: how badly can the attacker disrupt the service?
Not Defined: Not set. The calculator uses the Base value.
The Common Vulnerability Scoring System (CVSS) is an open standard maintained by FIRST. It rates the technical severity of a vulnerability on a scale from 0.0 to 10.0.
| Severity | Score range |
|---|---|
| None | 0.0 |
| Low | 0.1 to 3.9 |
| Medium | 4.0 to 6.9 |
| High | 7.0 to 8.9 |
| Critical | 9.0 to 10.0 |
Exam tip: CVSS measures severity, not risk. To prioritise patching, combine it with threat intelligence (for example EPSS or the CISA KEV catalog) and the business value of the affected asset.
v3.1 was published in June 2019 and v4.0 in November 2023. Many scanners and the NVD still show v3.1, so expect both on exams and in the field.
Scoring logic ported from FIRST's CVSS v4.0 reference calculator (BSD-2-Clause). Source
CVSS v3.1 scores follow the equations and Roundup function in the FIRST CVSS v3.1 specification. See also the CVSS v4.0 specification and the CVE Browser. CVSS is owned by FIRST.Org, Inc. and is used here for education.