The common vulnerability scoring system (CVSS) is a way to assign scores to vulnerability on the basis of their principal characteristics. This score indicates the severity of a
CVSS has two versions of the scoring system CVSS2 and CVSS3, the cvss2 was released in the year 2007 and had a scoring range of 0 - 10 with three severity levels low, medium, and high whereas cvss3 is launched in the year 2015 having a scoring range of 0 - 10 with 5 severity levels none, low, medium, high, and critical. The Base, Temporal, and Environmental metric groups all remained the same, although there were some changes within the Base and Environmental groups to find out the accurate scores of the vulnerability.
How CVSS works
The CVSS score ranges from 0.0 to 10.0, where 1.0 is considered as least severe and 10.0 is the most severe. Mapping of CVSS score with qualitative ratings:
|
Base Score range |
Severity |
|---|---|
|
0.0 |
None |
|
0.1 – 3.9 |
Low |
|
4.0 – 6.9 |
Medium |
|
7.0 – 8.9 |
High |
|
9.0 – 10.0 |
Critical |
CVSS Score Metrics
A CVSS score is derived from three sets of metrics Base, Terminal, and Environmental. These three metrics cover the different characteristics of a vulnerability, its impact, and environmental tolerance over time.
Base Metrics
The base metrics represent the base score ranging from 0 - 10 and the inherent characteristics of a vulnerability that is, these characteristics don’t change over time. It is made up of two sets of Metrics:
Exploitability Metrics:
- Attack vector
- Attack complexity
- Privileges required
- User interaction
- Scope
Impact Metrics:
- Confidentiality impact
- Integrity Impact
- Availability Impact
Temporal Metrics
The temporal Metrics represent the characteristics of a vulnerability that change over time. Additionally, it contains the Report Confidence metric, which measures the degree of assurance in the existence of the vulnerability. It consists of three metrics groups:
- Exploit code maturity
- Remediation Level
- Report Confidence
Environmental Metrics
The environmental metrics represent the characteristics of a vulnerability that are relevant and have an impact on a particular user’s environment. Environmental metrics categories include:
- Collateral damage potential
- Confidentiality requirement
- Integrity requirement
- Availability requirement
For example, consider a vulnerability having a CVSS score of 6.5 and having a vector:
The above vector value indicates:
AV: L - (Attack Vector) It means that the vulnerability is exploitable by local access.
AC: L - (Attack complexity) This vector value indicates that a specialized access condition does not exist.
PR: L - (Privileges required) It indicates that the attacker is authorized with privileges that provide basic user capabilities.
UI: N - (User interaction) The vulnerable system can be exploited without interaction from any user.
S: U - (Scope) An exploited vulnerability can only affect resources managed by the same authority.
C: H - (Confidentiality impact) There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker.
I: H - (Integrity impact) There is a total loss of integrity.
A: H - (Availability impact) Loss of availability means the attacker is able to fully deny access to resources in the impacted component.
E: U - (Exploit code maturity) No exploit code is available, or an exploit is entirely theoretical.
RL: O - (Remediation Level) A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
RC: R - (Report Confidence) Reasonable confidence exists, however, that the big is reproducible and at least one impact is able to be verified.
CR: H - (Confidentiality requirement) Loss of confidentiality is likely to have a catastrophic adverse effect on the organization.
IR: H - (Integrity requirement) Loss of integrity is likely to have a catastrophic adverse effect on the organization.
AR: L - (Availability requirement) Loss of availability is likely to have a limited adverse effect on the organization.
Also published here.