Definition
CVSS is an open standard that rates the severity of a software vulnerability on a scale from 0.0 to 10.0, based on how it can be exploited and what an attacker could gain.
How CVSS works
CVSS turns the technical details of a vulnerability into a number between 0.0 and 10.0. The standard is maintained by FIRST (the Forum of Incident Response and Security Teams), and the score is published alongside most CVE entries, for example in the US National Vulnerability Database (NVD).
The score is built from a set of metrics, each with a few possible values. Together they answer two questions: how hard is it to exploit? and how bad is it if someone does?
Severity ratings
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
The base metrics
The base score describes the vulnerability itself, independent of any particular environment. In CVSS v3.1 it uses:
- Attack Vector: how close the attacker must be: over the network, from an adjacent network, with local access or with physical access
- Attack Complexity: whether exploitation needs special conditions outside the attacker's control
- Privileges Required: whether the attacker needs an account, and how powerful
- User Interaction: whether a victim has to do something, such as open a file or click a link
- Scope: whether the impact can spread beyond the vulnerable component
- Confidentiality, Integrity and Availability: how much data can be read, changed or made unavailable
Reading a CVSS vector
Scores are usually published with a vector string that shows every metric value. For example:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
reads as: exploitable over the network, low complexity, no privileges, no user interaction, with high impact on confidentiality, integrity and availability. That combination scores 9.8 (Critical).
CVSS v3.1 vs CVSS v4.0
CVSS v4.0, released by FIRST in 2023, keeps the 0 to 10 scale but changes how it gets there:
- Attack Requirements is a new base metric for conditions on the target that exploitation depends on
- Scope is replaced by separate impact ratings for the vulnerable system and for systems affected after it
- Threat metrics replace v3.1's Temporal metrics and reflect whether exploits exist in the wild
- Supplemental metrics add context such as automatability and recovery, without changing the score
- Scores are labelled by what they include: CVSS-B (base only), CVSS-BT (base and threat), CVSS-BE (base and environmental) and CVSS-BTE (all three)
Both versions are in use, so check which one a score refers to before comparing two vulnerabilities.
What CVSS does not tell you
CVSS measures severity, not risk. A base score is the same for every organisation, whatever their setup. It cannot tell you:
- whether the vulnerable software is actually reachable in your environment
- whether other controls, such as segmentation or a WAF, already block the attack
- whether attackers are exploiting it right now
- how valuable the affected system is to your business
That is why a Critical finding on an isolated test server can matter less than a Medium finding on an internet-facing system that leads to customer data. Many teams combine CVSS with other signals, such as the EPSS probability of exploitation or CISA's Known Exploited Vulnerabilities (KEV) catalogue.
How Plainsea uses CVSS
Plainsea reports CVSS scores so findings fit into existing vulnerability management workflows, but it does not stop there. Every finding is confirmed exploitable in your environment, with the attack path that leads to it. That lets your team prioritise by what an attacker can actually do, not only by a number from a database.