What Is CVSS? Your Guide to Vulnerability Scoring

Base Metrics: The Foundation

Base metrics focus on the inherent characteristics of a vulnerability. They're like the DNA of the security flaw—these qualities don't change regardless of your specific environment.

Exploitability factors include:

• Attack Vector: Can attackers exploit this remotely, or do they need physical access?

• Attack Complexity: Is this vulnerability easy to exploit, or does it require advanced skills?

• Privileges Required: Does the attacker need admin rights, or can anyone exploit this?

• User Interaction: Must a user click something, or can this be exploited automatically?

Impact factors measure:

• Confidentiality: How much sensitive data could be exposed?

• Integrity: Can attackers modify or delete important information?

• Availability: Will this vulnerability disrupt system access or functionality?

Temporal Metrics: The Reality Check

Temporal metrics acknowledge that vulnerabilities evolve over time. A brand-new vulnerability might seem scary on paper, but if there's no known exploit code and a patch is already available, the real-world risk drops significantly.

These metrics consider:

• Exploit Code Maturity: Are working exploits publicly available?

• Remediation Level: Is there an official patch, workaround, or just temporary fixes?

• Report Confidence: How certain are we that this vulnerability actually exists and works as described?

Environmental Metrics: Your Specific Context

This is where CVSS gets personal. Environmental metrics let you adjust scores based on your organization's unique situation—because a "critical" vulnerability on an isolated test server isn't the same as one on your customer database.

Key considerations:

• Security Requirements: How important is the affected system to your business?

• Modified Base Metrics: Do your existing security controls reduce the vulnerability's impact?