Reference knowledge base for the Common Vulnerability Scoring System (CVSS) v3.1 and v4.0, including metric definitions, scoring guidance, and practical application.
Knowledge Base
CVSS v3.1
CVSS v3.1 is the most widely used vulnerability scoring system. It produces a score from 0.0 to 10.0 across three metric groups: Base, Temporal, and Environmental.
Base Metrics
Base metrics represent the intrinsic characteristics of a vulnerability that are constant over time and across environments.
Attack Vector (AV) -- How the vulnerability is exploited:
| Value | Code | Description | Example |
|---|---|---|---|
| Network | N | Exploitable via network, no special access needed | Remote code execution via HTTP request |
| Adjacent | A | Requires adjacent network access (same LAN, Bluetooth, etc.) | ARP spoofing attack |
| Local | L | Requires local access (shell, physical keyboard, local app) | Privilege escalation from local user |
| Physical | P | Requires physical access to the device | USB-based attack, cold boot attack |
Attack Complexity (AC) -- Conditions beyond attacker control:
| Value | Code | Description | Example |
|---|---|---|---|
| Low | L | No special conditions required | Sending a crafted HTTP request |
| High | H | Requires specific conditions (race condition, MITM position, specific config) | Exploiting a race condition with tight timing window |
Privileges Required (PR) -- Level of privileges needed before exploitation:
| Value | Code | Description | Example |
|---|---|---|---|
| None | N | No authentication needed | Unauthenticated RCE |
| Low | L | Basic user-level access | Authenticated user exploiting IDOR |
| High | H | Significant privileges (admin) | Admin panel vulnerability |
User Interaction (UI) -- Whether a user other than the attacker must participate:
| Value | Code | Description | Example |
|---|---|---|---|
| None | N | No user interaction needed | Server-side vulnerability exploited directly |
| Required | R | User must perform an action | Clicking a malicious link (XSS), opening a file |
Scope (S) -- Whether exploitation impacts resources beyond the vulnerable component:
| Value | Code | Description | Example |
|---|---|---|---|
| Unchanged | U | Impact limited to the vulnerable component | SQLi affecting only the database |
| Changed | C | Impact extends beyond the vulnerable component | VM escape, XSS (browser is vulnerable component, user's session in different origin is impacted) |
Impact Metrics (C/I/A) -- Effect on Confidentiality, Integrity, and Availability:
| Value | Code | Description |
|---|---|---|
| None | N | No impact |
| Low | L | Limited impact, partial data exposure or modification |
| High | H | Total loss of confidentiality, integrity, or availability |
Severity Ratings
| Score Range | Rating |
|---|---|
| 0.0 | None |
| 0.1 - 3.9 | Low |
| 4.0 - 6.9 | Medium |
| 7.0 - 8.9 | High |
| 9.0 - 10.0 | Critical |
Common Scoring Examples
SQL Injection (unauthenticated, data extraction):
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Score: 9.1 (Critical)
- Rationale: Network-accessible, no complexity, no privileges, no interaction, high confidentiality and integrity impact
Reflected XSS:
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Score: 6.1 (Medium)
- Rationale: Network-accessible, but requires user interaction (clicking link), scope changed (browser context), low impact per occurrence
Stored XSS (admin panel):
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Score: 5.4 (Medium)
- Rationale: Requires low privileges to inject, still needs victim interaction, scope changed
Remote Code Execution (unauthenticated):
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Score: 9.8 (Critical)
- Rationale: The worst case -- network-accessible, no barriers, complete system compromise
Local Privilege Escalation (kernel):
- Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Score: 7.8 (High)
- Rationale: Requires local access and low privileges, but gives complete control
IDOR (data exposure):
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Score: 6.5 (Medium)
- Rationale: Requires authentication (low privileges), reads data but doesn't modify
SSRF (cloud metadata):
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Score: 8.6 (High)
- Rationale: Unauthenticated, scope changed (accessing cloud metadata service), high confidentiality impact (credentials)
Temporal Metrics
Temporal metrics adjust the base score based on factors that change over time:
Exploit Code Maturity (E):
| Value | Code | Description |
|---|---|---|
| Not Defined | X | Default, no adjustment |
| Unproven | U | No exploit code available |
| Proof-of-Concept | P | PoC exists but not practical |
| Functional | F | Working exploit available |
| High | H | Reliable, automated exploitation (worm, Metasploit module) |
Remediation Level (RL):
| Value | Code | Description |
|---|---|---|
| Not Defined | X | Default |
| Official Fix | O | Vendor-provided patch available |
| Temporary Fix | T | Workaround available |
| Workaround | W | Unofficial mitigation |
| Unavailable | U | No fix or workaround available |
Report Confidence (RC):
| Value | Code | Description |
|---|---|---|
| Not Defined | X | Default |
| Unknown | U | Unconfirmed reports |
| Reasonable | R | Multiple sources, some detail |
| Confirmed | C | Vendor confirmed, detailed analysis available |
Environmental Metrics
Environmental metrics customize the score for a specific organization's environment by modifying the impact metrics and adding security requirements:
- Modified Base Metrics: Adjust any base metric to reflect the actual environment
- Confidentiality/Integrity/Availability Requirements: Rate as Low/Medium/High based on the asset's business criticality
CVSS v4.0
CVSS v4.0 (released November 2023) provides more granular scoring with additional metric groups.
Key differences from v3.1:
- Scope removed: Replaced with explicit "Subsequent System" impact metrics
- Attack Requirements (AT): New metric replacing some aspects of Attack Complexity
- New supplemental metrics: Automatable, Recovery, Value Density, Vulnerability Response Effort, Provider Urgency
- Threat metrics: Replaces Temporal metrics with simplified threat intelligence integration
- Nomenclature: CVSS-B (base only), CVSS-BT (base+threat), CVSS-BE (base+environmental), CVSS-BTE (all)
New metric -- Attack Requirements (AT):
| Value | Description |
|---|---|
| None | No special deployment or execution conditions |
| Present | Requires specific conditions (race condition, specific configuration, MITM position) |
Subsequent System Impact (replaces Scope): Separate Confidentiality, Integrity, and Availability impact ratings for the Vulnerable System and the Subsequent System (if impact crosses boundaries).
Patterns
Scoring Best Practices
- Score the vulnerability, not the exploit: Base score reflects the worst reasonable outcome, not a specific exploit technique
- Scope is about trust boundaries: Changed scope means the vulnerability in component A impacts component B across a trust boundary (e.g., XSS: browser is vulnerable, web application's session is impacted)
- Attack Complexity reflects conditions, not skill: AC:H means specific conditions must exist (race condition, specific config), not that the attacker needs to be skilled
- User Interaction means a victim action: The attacker must convince a user to do something. Clicking a link counts. Being on the same network doesn't.
- Use Environmental scoring for actual risk: A critical CVE in an air-gapped system is different from the same CVE on an internet-facing server. Environmental metrics capture this.
Priority vs Severity
CVSS provides severity (how bad the vulnerability is). Priority (what to fix first) requires additional context:
| Factor | Source | How It Modifies Priority |
|---|---|---|
| Active exploitation | CISA KEV, threat intel | Massively increases priority |
| Exploit availability | Exploit-DB, Metasploit | Increases priority |
| EPSS score | FIRST EPSS | Probability-based urgency |
| Asset criticality | Business context | Amplifies or reduces priority |
| Exposure level | Network architecture | Internet-facing >> internal |
| Compensating controls | Security architecture | May reduce priority if controls are strong |
| Fix availability | Vendor advisory | No fix = compensating controls only |
| Fix effort | Engineering assessment | Low-effort fixes first for quick wins |
Anti-Patterns
- Using only CVSS base scores for prioritization: Base scores ignore environmental context and threat intelligence. A CVSS 9.8 vulnerability that requires a configuration nobody uses and has no known exploit may be lower priority than a CVSS 7.0 with a Metasploit module actively used in the wild.
- Scoring inflation: Maximizing every metric to get the highest score. Score accurately, not dramatically.
- Ignoring Scope: Scope:Changed is frequently misassigned. It specifically means the vulnerability crosses a security authority boundary.
- Treating CVSS as a risk score: CVSS measures technical severity. Risk = severity x likelihood x asset value. CVSS alone is not risk.
- One score for all instances: The same CVE in different environments has different environmental scores. A SQL injection on a public-facing application has different risk than the same bug on an internal tool.