Common Vulnerability Scoring System (CVSS)

Overview

The Common Vulnerability Scoring System provides structured metrics for communicating the technical severity and context of software vulnerabilities. A vector records metric values, while a numerical score and qualitative rating summarize the selected characteristics under a specified CVSS version.

CVSS 4.0 separates Base, Threat, Environmental, and Supplemental metric groups. Earlier versions use different terminology and formulas, so reports should always state the version and full vector rather than comparing numbers without methodological context.

A CVSS score measures severity, not organizational risk or remediation priority by itself. Teams should combine it with exploit activity, asset importance, exposure, available controls, business impact, and deployment context before deciding when and how to remediate.

CVSS is an open framework for describing software vulnerability characteristics and calculating standardized severity scores and vector strings. CVSS standardizes vulnerability severity, but prioritization still requires asset context, exposure, threat intelligence, and the stated scoring version.

Assessment of Common Vulnerability Scoring System (CVSS) should trace CVSS is an open framework for describing software vulnerability characteristics and calculating standardized severity scores and vector strings from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving CVSS is an open framework for should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Common Vulnerability Scoring context should be tested against the architecture associated with CVSS is an open framework for.

Retesting for Common Vulnerability Scoring System (CVSS) should reproduce the Common Vulnerability Scoring context involving CVSS is an open framework for, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.