Common Vulnerability Scoring System
lastmod 2024-11-06created 2024-11-062 edits
CVSS stands for "Common Vulnerability Scoring System." It is an open framework that helps identify the characteristics and severity of software vulnerabilities. When vendors use their own scoring systems, responding to vulnerabilities can become complicated. With CVSS, organizations can assess the severity of IT vulnerabilities across multiple pieces of software using a unified scoring method. CVSS scores help determine which vulnerabilities to prioritize for immediate remediation.
CVSS is a concept first introduced by the NIAC in 2005. It is currently maintained by the Forum of Incident Response and Security Teams (FIRST). FIRST's CVSS stakeholder group (SIG) was responsible for the initial design of the CVSS framework and for refining the formulas of new versions. The CVSS SIG is made up of representatives from a variety of industries.
CVSS Versions
CVSS has gone through several revisions since its introduction.
Version 1
CVSS v1 was published in 2005 by the US National Infrastructure Advisory Council (NIAP). Its purpose was to establish a standard for the severity of vulnerabilities in software.
Version 2
v2 was established to address the shortcomings of CVSS v1. Released in 2007, CVSS v2 was a major improvement over v1. It reduced inconsistencies, reflected the practical characteristics of IT vulnerabilities, and strengthened the detailed aspects.
Version 3
However, v2 also had many problems, so v3 was released in 2015. CVSS v3 addresses concerns such as the privileges required to exploit a vulnerability and the opportunity for a hacker to get into the system after exploiting it. An improved CVSS v3.1 was released in 2019.
Version 3.1
A minor update to CVSS was released on June 17, 2019. The goal of CVSSv3.1 was to clarify and improve upon the existing CVSSv3.0 standard without introducing new metrics or metric values, allowing for frictionless adoption of the new standard by both scoring providers and scoring consumers alike. Usability was a prime consideration when making improvements to the CVSS standard. Several changes being made in CVSSv3.1 are to improve the clarity of concepts introduced in CVSSv3.0, and thereby improve the overall ease of use of the standard.
Version 4.0
Version 4.0 was officially released in November 2023, and is available at FIRST. Among several clarifications, the most notable changes are the new base metric Attack Requirements which complement the metric Attack Complexity with an assessment what conditions at the target side are needed to exploit a vulnerability. Further, the Impact metrics are split into impact on the vulnerable system itself and impact on subsequent systems (this replaces the Scope metric from prior versions).
Calculator
Metric Values
| Metric | Metric Value | Numerical Value |
| Attack Vector / Modified Attack Vector | Network | 0.85 |
| Adjacent | 0.62 | |
| Local | 0.55 | |
| Physical | 0.2 | |
| Attack Complexity / Modified Attack Complexity | Low | 0.77 |
| High | 0.44 | |
| Privileges Required / Modified Privileges Required | None | 0.85 |
| Low | 0.62 (or 0.68 if Scope / Modified Scope is Changed) | |
| High | 0.27 (or 0.5 if Scope / Modified Scope is Changed) | |
| User Interaction / Modified User Interaction | None | 0.85 |
| Required | 0.62 | |
| Confidentiality / Integrity / Availability / Modified Confidentiality / Modified Integrity / Modified Availability | High | 0.56 |
| Low | 0.22 | |
| None | 0 | |
| Exploit Code Maturity | Not Defined | 1 |
| High | 1 | |
| Functional | 0.97 | |
| Proof of Concept | 0.94 | |
| Unproven | 0.91 | |
| Remediation Level | Not Defined | 1 |
| Unavailable | 1 | |
| Workaround | 0.97 | |
| Temporary Fix | 0.96 | |
| Official Fix | 0.95 | |
| Report Confidence | Not Defined | 1 |
| Confirmed | 1 | |
| Reasonable | 0.96 | |
| Unknown | 0.92 | |
| Confidentiality Requirement / Integrity Requirement / Availability Requirement | Not Defined | 1 |
| High | 1.5 | |
| Medium | 1 | |
| Low | 0.5 |
Base Score Metrics
Exploitability Metrics
Attack Vector (AV)
Attack Complexity (AC)
Privileges Required (PR)
A measure of the level of privileges required for a vulnerability to be exploited, divided into the following levels.
The impact of PR is a very important factor in assessing how difficult a vulnerability is to attack, and it is reflected in the score as follows.
| Value | Description | Impact (Unchanged environment) | Impact (Changed environment 1) |
| None | No additional privileges at all are required for exploitation. An attacker can exploit it as a regular user or even while unauthenticated. | High impact: no effect on the score (calculated as the highest risk) | High impact: no effect on the score |
| Low | Low-level privileges are required for exploitation. Access is possible with regular user privileges or lower, and the vulnerability can be exploited through specific operations or requests. | Medium impact: score reduced by a factor of 0.62 | Medium impact: score reduced by a factor of 0.68 |
| High | High-level privileges are required for exploitation. Administrator privileges or similar elevated privileges are required, and access is possible only through highly privileged accounts. | Low impact: score reduced by a factor of 0.27 | Low impact: score reduced by a factor of 0.5 |
So you can think of it as "[Dangerous] - None - Low - High - [Safe]".
As an example, look at Security Bulletin: NVIDIA GPU Display Driver - October 2024 | NVIDIA:
| CVE ID | Description | Vector | Base Score | Severity | CWE | Impacts |
| NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. | 8.2 | High | Code execution, denial of service, escalation of privileges, information disclosure, and data tampering | |||
| NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. | 7.8 | High | Code execution, denial of service, escalation of privileges, information disclosure, and data tampering |
- CVE‑2024‑0126 says "vulnerability which could allow a privileged attacker to escalate permissions." ("It contains a vulnerability that could allow a privileged attacker to escalate privileges.") <- PR:H
- CVE‑2024‑0117 says "vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read." ("It contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read.") <- PR:N
User Interaction (UI)
- None (UI:N)
- Required (UI:R)
Scope
- Unchanged (S:U)
- Changed (S:C)
See also
Favorite site
- Common Vulnerability Scoring System - Wikipedia
- CVSS: Everything you need to know about the Common Vulnerability Scoring System (CVSS) -
References
-
if Scope / Modified Scope is Changed ↩