CVSS: what the score means
CVSS (Common Vulnerability Scoring System) is the open standard, maintained by the international organisation FIRST, that gives a vulnerability a score from 0.0 to 10.0 based on its technical characteristics.
In short
CVSS turns into a number how easy a vulnerability is to exploit and how much damage it can do. The number is read on a qualitative scale, the same in versions 3.1 and 4.0:
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
How it works
In version 3.1 the base score comes from eight metrics: attack vector (network, adjacent network, local, physical), attack complexity, privileges required, user interaction, scope, and impact on confidentiality, integrity and availability. The result is also written as a string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8, meaning exploitable from the internet, with no credentials, without anyone clicking anything, with full impact.
Version 4.0, published by FIRST at the end of 2023, drops the scope metric, adds attack requirements (AT) and separates the impact on the vulnerable system from the impact on downstream systems. The metric groups become Base, Threat, Environmental and Supplemental, and the notation shows which were used: CVSS-B for the base score alone, CVSS-BT if the threat is taken into account, CVSS-BTE if the environment is added.
Why it matters
CVSS is the common language for ordering hundreds of findings. But it measures technical severity, not the risk to your company. The published score is almost always the base score only: it does not know whether the system is exposed on the internet, whether it holds sensitive data, or whether the vulnerability is already being exploited. To set priorities it is worth combining it with the criticality of the asset and with signs of real-world exploitation, such as CISA's KEV catalogue of actively exploited vulnerabilities.
Example
A vulnerability assessment finds two problems: a CVE scoring 9.8 on an isolated test server that is switched off most of the time, and one scoring 6.5 on the customer portal exposed on the internet, which handles personal data. Sorting by CVSS alone, you would deal with the test server first. Reasoning in terms of risk, the portal moves ahead. The score stays the same: the decision changes, and it should be written into the risk analysis and the patch management plan.
Related terms
- CVE: the identifier of the vulnerability the score refers to
- Residual risk
- Zero-day
- Attack Surface Management
Where you find it in Dottor Box
Every vulnerability assessment finding has a CVSS severity, in the critical, high, medium and low ratings. In the Attack Surface you state the criticality of each asset, so the technical score is read together with the importance of what is affected.
Vulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more SeeAttack Surface
A reasoned register of the networks, addresses, applications and domains to protect, with how critical each one is.
Learn more ProveReporting
Executive, technical and presentation reports with editable charts, generated automatically too.
Learn more