CVSS (Vulnerability Scoring) Reference
Reference 为 CVSS v3.1/v4.0 scoring: 进制, temporal, 和 environmental metrics.
CVSS v3.1 Metrics
CVSS Base Score captures intrinsic severity via Attack Vector (Network/Adjacent/Local/Physical), Attack Complexity, Privileges Required, User Interaction, Scope, and Impact (Confidentiality/Integrity/Availability). The score ranges 0.0-10.0 with severity bands: None, Low, Medium, High, Critical. Temporal metrics adjust for exploit availability and remediation status. Environmental metrics customize for specific deployments. The vector string encodes all metrics compactly.
- Attack Vector
- N/A/L/P
- Impact
- C/I/A
- vector string
- Compact encoding
network to physicalconfidentiality/integrity/availabilityCVSS:3.1/AV:N/...CVSS v4.0
CVSS v4.0 adds more granular metrics and removes the separate temporal/environmental distinction in favor of a unified model. It includes supplemental metrics like Automatable, Recovery, Value Density, and Vulnerability Response Effort. The base score calculation changed to better reflect real-world severity. CVSS scores guide patch prioritization but should not be the sole factor. Context (asset value, exposure) often matters more than the raw score.
- v4.0
- Unified model
- Automatable
- Exploit automation
- context
- Asset value matters
more granularsupplemental metricnot just score