CVSS Calculator

What is CVSS?

CVSS, the Common Vulnerability Scoring System, is a vulnerability severity scoring system maintained by FIRST. A vector records the selected metrics and is used to calculate a score from 0 to 10. That score alone does not measure an organisation’s risk.

CVSS 4.0 and CVSS 3.1

The Common Vulnerability Scoring System, maintained by FIRST, rates a vulnerability from 0 to 10. FIRST published CVSS 4.0 in November 2023: it is the current version and opens by default. CVSS 3.1 is still common in CVE records, scanners and audit reports, hence the second tab. Paste a vector into “Load a vector” and the tool switches to the right version; a 3.0 vector is rescored as 3.1.

What changes in 4.0

CVSS 4.0 adds Attack Requirements (AT), which separate deployment conditions from Attack Complexity (AC). User Interaction distinguishes a passive victim from an active one. Scope (S) is gone: impact is rated separately on the vulnerable system (VC, VI, VA) and on subsequent systems (SC, SI, SA). The temporal group becomes “threat”, reduced to Exploit Maturity (E). Supplemental metrics (Safety, Automatable, Recovery and others) describe the flaw without changing the score.

The scoring changes too. The vector is placed in one of 270 MacroVectors, equivalence groups whose scores FIRST set with experts, then adjusted for the distance to the most severe vector of the group. Quote a 4.0 score with its nomenclature: CVSS-B for base only, CVSS-BT with threat, CVSS-BE with environmental, CVSS-BTE with both.

Exploitability

Attack Vector (AV) is Network when the flaw can be exploited remotely, including from the internet. Adjacent covers the same network segment, Bluetooth or Wi-Fi. Local assumes a session or a file opened on the machine, and Physical requires hardware access. Privileges Required (PR) and User Interaction (UI) say whether an account is needed and whether a victim has to act.

CVSS 3.1: scope, temporal, environmental

In 3.1, Scope (S) is Changed when exploitation reaches resources outside the authority of the vulnerable component, for example a container escape or an XSS that runs in the victim’s browser. Temporal metrics (exploit code maturity, remediation level, report confidence) can only lower the score. Environmental metrics weight the impact by the importance of the asset and let you redefine each base metric for your system.

The limits of the score

A CVSS score does not measure risk. A 9.8 on an isolated server can be less urgent than a 6.5 under active exploitation on your VPN gateway. Cross-check the score with known exploitation (CISA KEV), exploitation probability (EPSS) and the actual exposure of the asset.

A vendor’s published score reflects the reasonable worst case. Recompute it for your configuration rather than copying it, and record your choices: the vector is what makes the score verifiable.

Scoring engine

Scores are computed by the ae-cvss-calculator library by {metæffekt} (Apache-2.0), which implements the FIRST 3.1 and 4.0 specifications. Our tests check its output against reference vectors scored with the code of FIRST’s official calculator.