How does the CVSS scoring system classify vulnerabilities

Question

CVSS is used to rate the severity of security vulnerabilities. How does it work, and what factors are used in the scoring?

CaLLmeDaDDY · Answer 1 · Apr 10

The Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing the severity of security vulnerabilities in software systems. It assigns a numerical score ranging from 0 to 10 to indicate the severity, with higher scores representing more critical vulnerabilities. This scoring aids organizations in prioritizing their vulnerability management and remediation efforts.

Structure of CVSS:

CVSS evaluates vulnerabilities using multiple metric groups that capture various aspects of a vulnerability's characteristics and potential impact. The structure has evolved over different versions:

Base Metrics: These represent the intrinsic qualities of a vulnerability that are constant over time and across user environments.
Temporal Metrics: These reflect characteristics of a vulnerability that may change over time, such as the availability of exploit code or the release of patches.
Environmental Metrics: These account for the specific implementation and environment where the vulnerable system resides, allowing organizations to adjust the Base score based on their unique context.

In CVSS version 4.0, released in November 2023, the metric groups were updated to include:

Base Metrics: Assess the inherent characteristics of a vulnerability.
Threat Metrics: Evaluate factors like the availability of exploit code and the presence of active exploitation.
Environmental Metrics: Consider the specific environment and implementation details of the affected system.
Supplemental Metrics: Provide additional information that may be relevant for understanding and scoring the vulnerability.

Base Metrics in Detail:

The Base Metrics are fundamental to CVSS scoring and include several factors:

Attack Vector (AV): Indicates how the vulnerability can be exploited.
- Network (N): The vulnerability is exploitable from remote networks.
- Adjacent (A): Exploitation requires access to the local network or adjacent networks.
- Local (L): Exploitation requires local access to the system.
- Physical (P): Exploitation necessitates physical interaction with the system.
Attack Complexity (AC): Reflects the conditions beyond the attacker's control that must exist to exploit the vulnerability.
- Low (L): Exploitation is straightforward without specific conditions.
- High (H): Exploitation depends on specific conditions that may be difficult to meet.
Privileges Required (PR): Denotes the level of privileges an attacker must possess before exploiting the vulnerability.
- None (N): No privileges are required.
- Low (L): Requires privileges typically associated with normal users.
- High (H): Requires privileges associated with administrative users.
User Interaction (UI): Indicates whether exploitation requires user participation.
- None (N): Exploitation does not require any user interaction.
- Required (R): Exploitation requires user interaction.
Scope (S): Determines whether a vulnerability in one component can affect resources beyond its security scope.
- Unchanged (U): The exploited vulnerability cannot affect resources beyond its scope.
- Changed (C): The vulnerability can affect resources beyond its scope.
Impact Metrics: Assess the potential consequences on confidentiality, integrity, and availability:
- Confidentiality (C): Measures the impact on data confidentiality.
  - None (N): No impact on confidentiality.
  - Low (L): Limited unauthorized disclosure of information.
  - High (H): Total loss of confidentiality.
- Integrity (I): Measures the impact on data integrity.
  - None (N): No impact on integrity.
  - Low (L): Limited unauthorized modification of information.
  - High (H): Total loss of integrity.
- Availability (A): Measures the impact on system availability.
  - None (N): No impact on availability.
  - Low (L): Reduced performance or interruptions.
  - High (H): Total loss of availability.

Scoring Example

Consider a vulnerability that can be exploited remotely over a network, requires low attack complexity, no privileges, and no user interaction, leading to a complete compromise of confidentiality, integrity, and availability. The Base Score for this vulnerability would be calculated using the CVSS formula, resulting in a score that reflects its critical severity.

Severity Ratings

CVSS assigns qualitative severity ratings based on the numerical score: