Vulnerability severity calculator

How it works

CVSS gives a vulnerability a score from 0 to 10 and a vector string that records how the score was reached. This tool implements version 3.1 exactly as FIRST specifies it: base, temporal and environmental scores, the vector string both ways, and a view of how far each metric moves the result. For version 4.0 it checks and names a vector, then sends you to FIRST's calculator for the number.

1. Weigh the base metrics. Attack vector, complexity, privileges required and user interaction set how easy the flaw is to reach. Confidentiality, integrity and availability set how much is lost. Privileges required weighs more when the scope is changed.exploitability = 8.22 x AV x AC x PR x UI
2. Impact sub score. The impact sub score starts from the three impact weights. With the scope unchanged it is a straight multiple. With the scope changed the curve is steeper at the top, so a total loss in a changed scope is worth more.ISS = 1 − (1 − C) x (1 − I) x (1 − A); impact = 6.42 x ISS (scope unchanged); impact = 7.52 x (ISS − 0.029) − 3.25 x (ISS − 0.02)^15 (scope changed)
3. Base score. Add the two sub scores, cap at 10, and round up to one decimal. A changed scope multiplies by 1.08 first. A score of zero is given when the impact is zero or less. The round-up works on whole numbers so that a value such as 4.000000002 stays at 4.0.base = 0 if impact <= 0; else Roundup(Minimum(impact + exploitability, 10)); scope changed: Roundup(Minimum(1.08 x (impact + exploitability), 10))
4. Temporal score. Exploit code maturity, remediation level and report confidence can only lower the base score. Not defined counts as the neutral weight of 1.temporal = Roundup(base x E x RL x RC)
5. Environmental score. Your own security requirements scale the impacts (a high requirement weighs 1.5, low 0.5), capped at 0.915. Any base metric can be restated for your deployment (a modified metric); not defined keeps the base value. The modified impact and exploitability replace the base ones, and the temporal weights apply last.MISS = Minimum(1 − (1 − CR x MC) x (1 − IR x MI) x (1 − AR x MA), 0.915); modified impact = 6.42 x MISS (scope unchanged) or 7.52 x (MISS − 0.029) − 3.25 x (MISS x 0.9731 − 0.02)^13 (changed); environmental = Roundup(Roundup(Minimum(modified impact + modified exploitability, 10)) x E x RL x RC)
6. Severity rating. The score maps to a word: none for 0.0, low for 0.1 to 3.9, medium for 4.0 to 6.9, high for 7.0 to 8.9 and critical for 9.0 to 10.0.
7. Version 4.0 vectors. Version 4.0 adds attack requirements, splits impact into the vulnerable system and subsequent systems, and names its scores by the metric groups used: CVSS-B (base only), CVSS-BT (with threat), CVSS-BE (with environmental) and CVSS-BTE (with both). The tool checks that the prefix, every code and value and all eleven base metrics are valid, and gives the name. The number comes from FIRST's calculator.

Sources

The methods and default figures rest on these public sources. The wording here is our own; read the source for its full text.

• Common Vulnerability Scoring System v3.1: Specification Document (opens in a new tab), FIRST.Org, Inc., June 2019 (version 3.1). The metrics, weights, formulas, round-up function and severity ratings, followed as published. FIRST owns CVSS and the tool is used by permission under FIRST's terms.
• Common Vulnerability Scoring System v3.1: Examples (opens in a new tab), FIRST.Org, Inc., June 2019 (version 3.1). Worked examples with published base scores, reproduced in the tool's tests.
• Common Vulnerability Scoring System version 4.0: Specification Document (opens in a new tab), FIRST.Org, Inc., Version 1.2, 18 June 2024. Metric names, values, vector format and the CVSS-B, BT, BE and BTE nomenclature.