CVSS

CVSS (Common Vulnerability Scoring System) is a standardized scoring system for vulnerability severity, outputting 0-10 scores and maintained by FIRST.

Purpose

To provide a unified, comparable quantitative score of vulnerability severity to aid prioritization.

Mechanism

CVSS v3.1 computes from three metric groups: Base (intrinsic: attack vector, complexity, privileges, impact), Temporal (time-varying: exploit maturity, remediation), and Environmental (environment-specific: asset value). It outputs a Base score (0-10) and a vector string.

Use cases

Vulnerability prioritization
Security reports and dashboards
Compliance and risk quantification
Dependency scanning scores

Examples

Input
```
CVSS:3.1/AV:N/AC:L/PR:N
```
Output
```
Base 7.5 (High)
```
Network vector, low complexity

Common errors

Looking only at the Base score while ignoring environmental factors: Adjust actual risk with Environmental metrics

Related terms

CVE (Common Vulnerabilities and Exposures) is a system that assigns unique identifiers (CVE-YYYY-NNNN) to publicly disclosed security vulnerabilities, maintained by MITRE.

OWASP (Open Web Application Security Project) is a nonprofit organization that publishes the Top 10 Web vulnerability list and security practice guides; it is an authority on Web security.

Penetration Testing

Penetration testing is simulating attacker behavior to run authorized attack tests against a system, discovering exploitable vulnerabilities and assessing real risk.

References