CVSS v3.1 Calculator
The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a reproducible temporal and environmental score. This calculator uses CVSS v3.1 metrics.
Base Metrics
These metrics represent the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
Network (N)
Adjacent (A)
Local (L)
Physical (P)
Low (L)
High (H)
None (N)
Low (L)
High (H)
None (N)
Required (R)
Unchanged (U)
Changed (C)
High (H)
Low (L)
None (N)
High (H)
Low (L)
None (N)
High (H)
Low (L)
None (N)
Temporal Metrics (Optional)
These metrics reflect the characteristics of a vulnerability that change over time but not across user environments.
Not Defined (X)
High (H)
Functional (F)
Proof-of-Concept (P)
Unproven (U)
Not Defined (X)
Official Fix (O)
Temporary Fix (T)
Workaround (W)
Unavailable (U)
Not Defined (X)
Confirmed (C)
Reasonable (R)
Unknown (U)
Environmental Metrics (Optional)
These metrics allow for customization of the CVSS score depending on the importance of the affected IT asset to a user's organization.
Not Defined (X)
High (H)
Medium (M)
Low (L)
Not Defined (X)
High (H)
Medium (M)
Low (L)
Not Defined (X)
High (H)
Medium (M)
Low (L)
Not Defined (X)
Network (N)
Adjacent (A)
Local (L)
Physical (P)
Not Defined (X)
Low (L)
High (H)
Not Defined (X)
None (N)
Low (L)
High (H)
Not Defined (X)
None (N)
Required (R)
Not Defined (X)
Unchanged (U)
Changed (C)
Not Defined (X)
High (H)
Low (L)
None (N)
Not Defined (X)
High (H)
Low (L)
None (N)
Not Defined (X)
High (H)
Low (L)
None (N)
CVSS Scores:
Base Score: 0.0
Temporal Score: N/A
Environmental Score: N/A
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Breakdown and Interpretation
CVSS scores range from 0.0 to 10.0, with higher scores indicating greater severity. The scores are categorized as follows:
- None: 0.0
- Low: 0.1 – 3.9
- Medium: 4.0 – 6.9
- High: 7.0 – 8.9
- Critical: 9.0 – 10.0
The calculator provides three types of scores:
- Base Score: Represents the intrinsic severity of a vulnerability, constant over time and across user environments.
- Temporal Score: Modifies the Base Score to reflect the current state of exploit techniques, remediation availability, and confidence in the vulnerability report.
- Environmental Score: Customizes the Temporal Score based on the specific importance of the affected IT asset to an organization, considering factors like confidentiality, integrity, and availability requirements.
Understanding CVSS Metrics
Each metric contributes to the overall score, providing a detailed picture of the vulnerability's characteristics:
- Attack Vector (AV): How the vulnerability is exploited (Network, Adjacent, Local, Physical).
- Attack Complexity (AC): The difficulty of exploiting the vulnerability (Low, High).
- Privileges Required (PR): The level of privileges an attacker needs (None, Low, High).
- User Interaction (UI): Whether a user must perform an action for the attack to succeed (None, Required).
- Scope (S): Whether the vulnerability can impact resources beyond the vulnerable component's security scope (Unchanged, Changed).
- Confidentiality (C), Integrity (I), Availability (A): The impact on these security properties if the vulnerability is exploited (High, Low, None).
- Exploit Code Maturity (E): The current state of exploit techniques (Not Defined, High, Functional, Proof-of-Concept, Unproven).
- Remediation Level (RL): The availability of a fix (Not Defined, Official Fix, Temporary Fix, Workaround, Unavailable).
- Report Confidence (RC): The degree of confidence in the existence and exploitability of the vulnerability (Not Defined, Confirmed, Reasonable, Unknown).
- Confidentiality/Integrity/Availability Requirement (CR/IR/AR): The importance of these security properties to the organization (Not Defined, High, Medium, Low).
- Modified Attack Vector/Complexity/Privileges/User Interaction/Scope/Confidentiality/Integrity/Availability (MAV/MAC/MPR/MUI/MS/MC/MI/MA): These metrics allow an analyst to override the Base Metrics to reflect the specific environmental conditions.
Example Scenario: Web Application SQL Injection
Consider a SQL Injection vulnerability in a public-facing web application. Let's calculate its CVSS score:
- Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
- Attack Complexity (AC): Low (L) – No specialized conditions or extensive prior knowledge are required.
- Privileges Required (PR): None (N) – An attacker does not need any special privileges to exploit it.
- User Interaction (UI): None (N) – No user interaction is required for the attack.
- Scope (S): Changed (C) – A successful SQL injection might allow an attacker to access or modify data outside the web application's immediate security context (e.g., the underlying database).
- Confidentiality (C): High (H) – Sensitive data in the database could be fully disclosed.
- Integrity (I): High (H) – Data in the database could be fully modified or deleted.
- Availability (A): High (H) – The database or application could be rendered unavailable.
Using these Base Metrics, the calculator would yield a Base Score of 10.0 (Critical). The vector string would be: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Now, let's add some Temporal Metrics:
- Exploit Code Maturity (E): Functional (F) – Publicly available exploit code exists.
- Remediation Level (RL): Official Fix (O) – The vendor has released a patch.
- Report Confidence (RC): Confirmed (C) – The vulnerability has been confirmed by the vendor.
With these Temporal Metrics, the Temporal Score would be slightly reduced from the Base Score, reflecting the availability of a fix and confirmed status, but still very high.
Finally, for Environmental Metrics, if the web application handles highly sensitive customer data (e.g., financial information), the organization might set:
- Confidentiality Requirement (CR): High (H)
- Integrity Requirement (IR): High (H)
- Availability Requirement (AR): High (H)
These requirements would likely keep the Environmental Score very high, potentially matching the Base Score if the impact is already high, or even slightly increasing it if the base impact was lower but the requirement is high.