Cvss Score Calculator

Calculate the Common Vulnerability Scoring System (CVSS) v3.1 Base Score for a given vulnerability.

Understanding the CVSS v3.1 Score

The Common Vulnerability Scoring System (CVSS) is an industry standard for assessing the severity of computer system security vulnerabilities. It provides a way to capture the primary characteristics of a vulnerability and produce a numerical score reflecting its severity. CVSS v3.1 is the latest iteration, offering improved clarity and metrics.

CVSS Metrics

The CVSS Base score is composed of several metric groups:

Exploitability Metrics:

• Attack Vector (AV): Describes the context by which vulnerability exploitation is possible.
  • Network (N): Vulnerable system is reachable remotely via the network.
  • Adjacent (A): Vulnerable system is reachable only from a network adjacent to the vulnerable system.
  • Local (L): Vulnerable system is reachable only via local access (e.g., keyboard, console).
  • Physical (P): Vulnerable system is reachable only via physical access.
• Attack Complexity (AC): Represents the complexity of the attack required to exploit the vulnerability.
  • Low (L): Specialized access conditions or extenuating circumstances do not exist.
  • High (H): Significant hurdles must be overcome for exploitation.
• Privileges Required (PR): Describes the level of privileges an attacker must possess before successful exploitation.
  • None (N): No privileges are required.
  • Low (L): Low privileges are required (e.g., user account).
  • High (H): High privileges are required (e.g., administrator, root).
• User Interaction (UI): Measures whether a user must be involved in the exploitation.
  • None (N): No user interaction is required.
  • Required (R): A user must interact with the vulnerability for it to be exploited (e.g., clicking a link).
• Scope (S): Indicates whether a vulnerability in one component can affect resources beyond its security scope.
  • Unchanged (U): Exploitation impacts only the security scope of the vulnerable component.
  • Changed (C): Exploitation impacts resources beyond the security scope of the vulnerable component.

Impact Metrics:

• Confidentiality Impact (C): Measures the impact on the confidentiality of information.
  • None (N): No loss of confidentiality.
  • Low (L): Limited disclosure of information.
  • High (H): Total loss of confidentiality, all data is accessible.
• Integrity Impact (I): Measures the impact on the integrity (trustworthiness and correctness) of information.
  • None (N): No loss of integrity.
  • Low (L): Modification of data is possible but limited.
  • High (H): Total loss of integrity, unauthorized modifications are possible.
• Availability Impact (A): Measures the impact on the availability of the affected component.
  • None (N): No impact on availability.
  • Low (L): Reduced performance or degraded availability.
  • High (H): Total loss of availability, the component is unresponsive.

CVSS v3.1 Base Score Calculation (Simplified Overview)

The CVSS v3.1 score is calculated using a formula that first determines an Exploitability sub-score and then uses this, along with Scope and Impact metrics, to calculate the final Base Score. The formulas are complex and involve lookup tables and specific rules, particularly when Scope changes.

The core idea is to quantify risk based on how easily a vulnerability can be exploited and the severity of its consequences.

The Calculation Process:

1. Map discrete metric values to numerical weights. Each option (e.g., "Network" for AV) has an associated numerical value.
2. Calculate the Exploitability Score (E):
   E = 8.47 * AV * AC * PR * UI
   Where AV, AC, PR, and UI are the numerical weights corresponding to the selected values.
3. Determine the Impact Score (SI):
   If Scope (S) is Unchanged (U):
   SI = 6.42 * Impact
   Where Impact = 1 - [(1 - C) * (1 - I) * (1 - A)] (C, I, A are numerical weights for Confidentiality, Integrity, Availability).
   If Scope (S) is Changed (C):
   SI = 7.52 * [SI_Unchanged - 0.029] - 3.25 * [SI_Unchanged - 0.02]^15
   Where SI_Unchanged is calculated as above.
4. Calculate the Base Score (BS):
   If SI is 0:
   BS = 0
   Else if Scope is Unchanged (U):
   BS = RoundUp(Minimum(Exploitability + Impact, 10))
   Else if Scope is Changed (C):
   BS = RoundUp(Minimum(1.08 * (Exploitability + Impact), 10))

The scores are then mapped to qualitative ratings:

• None: 0.0
• Low: 0.1 – 3.9
• Medium: 4.0 – 6.9
• High: 7.0 – 8.9
• Critical: 9.0 – 10.0

Use Cases

The CVSS score is crucial for:

• Prioritization: Helping organizations prioritize vulnerability remediation efforts based on severity.
• Risk Assessment: Providing a common language and framework for discussing and understanding security risks.
• Communication: Enabling consistent communication about vulnerability severity between different stakeholders (e.g., vendors, security teams, management).
• Compliance: Assisting in meeting regulatory and compliance requirements.