The Common Vulnerability Scoring System (CVSS) is a widely used framework for evaluating and communicating the severity of software vulnerabilities. First introduced in 1999, CVSS has become the standard scoring method for organisations to prioritise security efforts and manage vulnerabilities systematically. By assigning numerical scores to vulnerabilities based on their characteristics, CVSS enables teams to assess risks and allocate resources effectively.

This article provides a detailed overview of CVSS, explains how it works, and explores its practical applications in cybersecurity.

Contents

1. The Purpose of CVSS

CVSS was developed to provide a standardised, repeatable method for scoring vulnerabilities, ensuring consistency in how organisations assess and respond to security threats. Its goals include:

• Prioritisation: Helping organisations focus on vulnerabilities with the greatest potential impact.
• Comparability: Standardising scores across different organisations and industries.
• Transparency: Offering a clear methodology for how scores are calculated.

CVSS is commonly used by vulnerability databases like the National Vulnerability Database (NVD) and security vendors to rate vulnerabilities and guide remediation efforts.

2. How CVSS Works

CVSS assigns scores on a scale from 0 to 10, where higher scores indicate more severe vulnerabilities. The scoring is divided into three metric groups: Base, Temporal, and Environmental.

2.1 Base Metrics (Core Severity)

The Base Score reflects the intrinsic severity of a vulnerability, independent of time or context. It considers:

• Attack Vector (AV): How the vulnerability can be exploited (e.g., network, adjacent, local).
• Attack Complexity (AC): The level of skill or conditions required to exploit the vulnerability (low or high).
• Privileges Required (PR): The level of access needed by an attacker (none, low, high).
• User Interaction (UI): Whether exploitation requires user action (none or required).
• Impact: The effect on Confidentiality (C), Integrity (I), and Availability (A).

Example: A vulnerability exploitable over the network with no privileges required and significant impact on confidentiality would have a high Base Score.

2.2 Temporal Metrics (Dynamic Factors)

The Temporal Score accounts for factors that change over time, such as:

• Exploit Code Maturity (E): Whether exploit tools are publicly available.
• Remediation Level (RL): The availability of a patch or workaround.
• Report Confidence (RC): The reliability of the vulnerability’s details.

These metrics allow organisations to adjust scores as circumstances evolve.

2.3 Environmental Metrics (Organisational Context)

The Environmental Score enables organisations to modify the Base Score based on their specific context:

• Modified Impact Metrics: Adjust confidentiality, integrity, or availability impacts based on asset importance.
• Security Requirements: Assign weights (low, medium, high) to assets affected by the vulnerability.

Example: A vulnerability on a public-facing server hosting critical customer data may have a higher Environmental Score than the same vulnerability on a test server.

3. CVSS Scoring Example

Consider a vulnerability in a web application:

• Base Metrics: The vulnerability can be exploited over the network (AV: Network), requires no privileges (PR: None), and affects availability (A: High). The Base Score is calculated as 8.2 (High).
• Temporal Metrics: If an exploit is available and a patch has been released, the score may adjust to 7.5 (High).
• Environmental Metrics: For an organisation with critical operations relying on the affected application, the score could rise to 9.0 (Critical) due to increased impact.

4. Applications of CVSS

4.1 Vulnerability Management

CVSS is integral to prioritising vulnerabilities for patching and mitigation. High-scoring vulnerabilities are addressed first, ensuring critical systems are secured promptly.

Example: A CVSS score of 9.8 on a remote code execution vulnerability would trigger an immediate patching process, while a 4.0 score might be deferred.

4.2 Risk Communication

CVSS simplifies complex vulnerabilities into a single score, making it easier for technical teams to communicate risks to executives or regulators.

Example: A security team reports that 70% of the organisation’s critical vulnerabilities have been addressed, as measured by CVSS scores.

4.3 Vendor and Third-Party Risk Management

Organisations use CVSS scores to evaluate the security posture of third-party vendors and ensure compliance with minimum security requirements.

Example: A retailer may require all software providers to remediate vulnerabilities with CVSS scores above 7.0 within 30 days.

5. Strengths of CVSS

• Standardisation: CVSS is widely adopted, providing a common language for assessing vulnerabilities.
• Customisation: Environmental Metrics allow organisations to tailor scores to their specific contexts.
• Actionability: Scores provide clear prioritisation for vulnerability management.

6. Limitations of CVSS

• Static Nature: Base Scores do not account for rapidly evolving threat landscapes unless updated.
• Context Sensitivity: Without using Environmental Metrics, scores may not fully reflect an organisation’s specific risks.
• Subjectivity: Temporal and Environmental Metrics require judgement, which can introduce variability.

7. The Future of CVSS

As cybersecurity evolves, CVSS is likely to be enhanced with:

• Automation: Integrating AI and machine learning to automatically adjust scores based on real-time threat intelligence.
• Expanded Metrics: Including additional factors like asset value or system interdependencies.
• Interoperability: Aligning CVSS with other frameworks, such as FAIR or NIST CSF, to provide a more holistic view of risk.

Conclusion

CVSS remains a cornerstone of vulnerability management, providing organisations with a standardised and actionable approach to assessing and prioritising risks. By leveraging its Base, Temporal, and Environmental Metrics, organisations can contextualise vulnerabilities and align their responses with organisational priorities. While CVSS has limitations, its widespread adoption and adaptability ensure its continued relevance in an ever-changing cybersecurity landscape.