What is CVSS?

What is CVSS?

The Common Vulnerability Scoring System (CVSS) describes a vulnerability with a set of standard metrics and turns them into a score from 0.0 to 10.0. It is maintained by FIRST, the Forum of Incident Response and Security Teams. Version 3.1 is still the most widely published; version 4.0 was released in November 2023 and increasingly appears alongside it. Vendors, the National Vulnerability Database and scanners print CVSS scores next to CVE IDs, so the number is often the first thing an analyst sees.

Both versions use the same severity bands:

The edges matter: 6.9 is Medium, 7.0 is High, 8.9 is High and 9.0 is Critical.

The base metrics

In version 3.1 the base score comes from eight metrics. Attack Vector (AV) says where the attacker must be: Network, Adjacent, Local or Physical. Attack Complexity (AC) is Low or High. Privileges Required (PR) is None, Low or High. User Interaction (UI) is None or Required. Scope (S) is Unchanged or Changed, depending on whether an exploit can affect components beyond the vulnerable one, such as a virtual machine escaping to its host. Confidentiality, Integrity and Availability (C, I, A) are each rated High, Low or None.

Version 4.0 adds Attack Requirements (AT), splits user interaction into Passive and Active, and replaces Scope with separate impact ratings for the vulnerable system and for subsequent systems.

Reading a vector string

Every score comes with a vector string that records each metric value:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Read it left to right: version 3.1, network attack vector, low complexity, no privileges, no user interaction, scope unchanged, and high impact on all three. That scores 9.8, Critical, and is the profile of unauthenticated remote code execution. Changing one metric shows how the score moves:

• PR:L, the attacker needs a low-privilege account: 8.8, High
• UI:R, a user must open a file or click a link: 8.8, High
• C:H/I:N/A:N, data disclosure only: 7.5, High
• S:C, impact crosses into other components: 10.0, Critical, the score Log4Shell (CVE-2021-44228) received

The vector often says more than the number. A 7.5 unauthenticated data leak on an internet-facing server and a 7.8 local privilege escalation call for different responses even though the scores are close.

Base, temporal (threat) and environmental metrics

Base metrics describe the flaw itself and are the same everywhere; they are what most people mean by the CVSS score. Temporal metrics in 3.1 track what changes over time, such as exploit code maturity and whether an official fix exists, and they can only lower the score. Version 4.0 renames this group Threat and keeps only exploit maturity. Environmental metrics let the organization running the software adjust the score for its own deployment, for example by weighting confidentiality as High for a system that holds personal data. Version 4.0 also adds Supplemental metrics, such as Safety and Automatable, which add context without changing the score.

Severity is not risk

FIRST's specification says CVSS measures severity, not risk. A base score doesn't know whether the system faces the internet, what it holds, or whether attackers are using the flaw today. Analysts combine it with CISA's Known Exploited Vulnerabilities (KEV) catalog of CVEs exploited in the wild; with EPSS, FIRST's estimate of the probability that a CVE will be exploited in the next 30 days; and with exposure and asset criticality from the inventory. An actively exploited 7.8 on a domain controller should be fixed before a 9.8 on an isolated lab server that is about to be retired.

CVSS on the CompTIA Security+ exam

CVSS appears under SY0-801 objective 2.1, which covers rating vulnerability severity, and again in objective 4.3, where analysts use scores to prioritize remediation. Know the bands and their edges, and translate scenario wording into metrics: "exploitable remotely without credentials" is AV:N with PR:N, "the victim must open an attachment" is UI:R, and "the attacker must be on the same subnet" is AV:A. "Adjust the score for how critical the system is to us" points to environmental metrics, while "exploit code was just released" points to temporal or threat metrics. When a question asks what to fix first, a lower-scored flaw that is actively exploited on an exposed or critical system usually beats a higher score elsewhere. CVE is the usual distractor: CVE names the flaw, and CVSS rates it.