CVSS Calculator

Attack Vector (AV)

This metric reflects the context by which vulnerability exploitation is possible.

• Network (N): The vulnerable system is bound to the network stack and the set of possible attackers extends up to and including the entire Internet.
• Adjacent (A): The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology.
• Local (L): The vulnerable system is not bound to the network stack and the attacker's path is via read/write/execute capabilities.
• Physical (P): The attack requires the attacker to physically touch or manipulate the vulnerable system.

Attack Complexity (AC)

This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit.

• Low (L): The attacker must take no measurable action to exploit the vulnerability.
• High (H): The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack.

Attack Requirements (AT)

This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.

• None (N): The successful attack does not depend on the deployment and execution conditions of the vulnerable system.
• Present (P): The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack.

Privileges Required (PR)

This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability.

• None (N): The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
• Low (L): The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user.
• High (H): The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system's settings and files.

User Interaction (UI)

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system.

• None (N): The vulnerable system can be exploited without interaction from any human user, other than the attacker.
• Passive (P): Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker's payload.
• Active (A): Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker's payload.

Vulnerable System Confidentiality Impact (VC)

This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability.

• High (H): There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker.
• Low (L): There is some loss of confidentiality.
• None (N): There is no loss of confidentiality within the Vulnerable System.

Vulnerable System Integrity Impact (VI)

This metric measures the impact to integrity of a successfully exploited vulnerability.

• High (H): There is a total loss of integrity, or a complete loss of protection.
• Low (L): Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited.
• None (N): There is no loss of integrity within the Vulnerable System.

Vulnerable System Availability Impact (VA)

This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.

• High (H): There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the vulnerable system.
• Low (L): Performance is reduced or there are interruptions in resource availability.
• None (N): There is no impact to availability within the Vulnerable System.

Subsequent System Confidentiality Impact (SC)

This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability.

• High (H): There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker.
• Low (L): There is some loss of confidentiality.
• None (N): There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.

Subsequent System Integrity Impact (SI)

This metric measures the impact to integrity of a successfully exploited vulnerability.

• High (H): There is a total loss of integrity, or a complete loss of protection.
• Low (L): Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited.
• None (N): There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.

Subsequent System Availability Impact (SA)

This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability.

• High (H): There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the subsequent system.
• Low (L): Performance is reduced or there are interruptions in resource availability.
• None (N): There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Exploit Maturity (E)

This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, "in-the-wild" exploitation.

• Not Defined (X): Reliable threat intelligence is not available to determine Exploit Maturity characteristics. The score assumes Attacked (the worst case).
• Attacked (A): Based on available threat intelligence, attacks targeting this vulnerability (attempted or successful) have been reported, or solutions to simplify attempts to exploit it are available.
• POC (P): Based on available threat intelligence, proof-of-concept exploit code is publicly available, with no knowledge of reported attempts to exploit this vulnerability.
• Unreported (U): Based on available threat intelligence, there is no knowledge of publicly available proof-of-concept exploit code and no knowledge of reported attempts to exploit this vulnerability.

These metrics enable the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst's organization.

Confidentiality Requirement (CR)

• Not Defined (X): This is the default value. It has the same effect as High (the worst case).
• High (H): Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Medium (M): Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Low (L): Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Integrity Requirement (IR)

• Not Defined (X): This is the default value. It has the same effect as High (the worst case).
• High (H): Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Medium (M): Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Low (L): Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Availability Requirement (AR)

• Not Defined (X): This is the default value. It has the same effect as High (the worst case).
• High (H): Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Medium (M): Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Low (L): Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Safety (S)

Like all Supplemental metrics, providing a value for Safety is optional. It describes the impact of the vulnerability on the safety of a human actor or participant.

• Not Defined (X): The metric has not been evaluated.
• Negligible (N): Consequences of the vulnerability meet the definition of IEC 61508 consequence category "negligible."
• Present (P): Consequences of the vulnerability meet the definition of IEC 61508 consequence categories of "marginal," "critical," or "catastrophic."

Automatable (AU)

Can an attacker automate exploitation events for this vulnerability across multiple targets?

• Not Defined (X): The metric has not been evaluated.
• No (N): Attackers cannot reliably automate all 4 steps of the kill chain for this vulnerability for some reason.
• Yes (Y): Attackers can reliably automate all 4 steps of the kill chain.

Recovery (R)

Recovery describes the resilience of a system to recover services, in terms of performance and availability, after an attack has been performed.

• Not Defined (X): The metric has not been evaluated.
• Automatic (A): The system recovers services automatically after an attack has been performed.
• User (U): The system requires manual intervention by the user to recover services, after an attack has been performed.
• Irrecoverable (I): The system services are irrecoverable by the user, after an attack has been performed.

Value Density (V)

Value Density describes the resources that the attacker will gain control over with a single exploitation event.

• Not Defined (X): The metric has not been evaluated.
• Diffuse (D): The vulnerable system has limited resources.
• Concentrated (C): The vulnerable system is rich in resources.

Vulnerability Response Effort (RE)

Supplemental information on how difficult it is for consumers to provide an initial response to the impact of vulnerabilities.

• Not Defined (X): The metric has not been evaluated.
• Low (L): The effort required to respond to a vulnerability is low/trivial.
• Moderate (M): The actions required to respond to a vulnerability require some effort on behalf of the consumer and could cause minimal service impact to implement.
• High (H): The actions required to respond to a vulnerability are significant and/or difficult, and may possibly lead to an extended, scheduled service impact.

Provider Urgency (U)

Many vendors provide supplemental severity ratings to consumers through product security advisories.

• Not Defined (X): The metric has not been evaluated.
• Clear (Clear): Provider has assessed the impact of this vulnerability as having no urgency (Informational).
• Green (Green): Provider has assessed the impact of this vulnerability as having a reduced urgency.
• Amber (Amber): Provider has assessed the impact of this vulnerability as having a moderate urgency.
• Red (Red): Provider has assessed the impact of this vulnerability as having the highest urgency.

Attack Vector (AV)

This metric reflects the context by which vulnerability exploitation is possible.

• Network (N): The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet.
• Adjacent (A): The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology.
• Local (L): The vulnerable component is not bound to the network stack and the attacker's path is via read/write/execute capabilities.
• Physical (P): The attack requires the attacker to physically touch or manipulate the vulnerable component.

Attack Complexity (AC)

This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.

• Low (L): Specialized access conditions or extenuating circumstances do not exist.
• High (H): A successful attack depends on conditions beyond the attacker's control.

Privileges Required (PR)

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

• None (N): The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
• Low (L): The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user.
• High (H): The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable component allowing access to component-wide settings and files.

User Interaction (UI)

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

• None (N): The vulnerable system can be exploited without interaction from any user.
• Required (R): Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.

Scope (S)

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

• Unchanged (U): An exploited vulnerability can only affect resources managed by the same security authority.
• Changed (C): An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component.

Confidentiality (C)

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

• High (H): There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker.
• Low (L): There is some loss of confidentiality.
• None (N): There is no loss of confidentiality within the impacted component.

Integrity (I)

This metric measures the impact to integrity of a successfully exploited vulnerability.

• High (H): There is a total loss of integrity, or a complete loss of protection.
• Low (L): Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited.
• None (N): There is no loss of integrity within the impacted component.

Availability (A)

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

• High (H): There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component.
• Low (L): Performance is reduced or there are interruptions in resource availability.
• None (N): There is no impact to availability within the impacted component.

Exploit Code Maturity (E)

This metric measures the likelihood of the vulnerability being attacked, and is typically based on the current state of exploit techniques, exploit code availability, or active, "in-the-wild" exploitation.

• Not Defined (X): Assigning this value indicates there is insufficient information to choose one of the other values, and has no impact on the overall Temporal Score, i.e., it has the same effect on scoring as assigning High.
• High (H): Functional autonomous code exists, or no exploit is required (manual trigger) and details are widely available.
• Functional (F): Functional exploit code is available.
• Proof-of-Concept (P): Proof-of-concept exploit code is available, or an attack demonstration is not practical for most systems.
• Unproven (U): No exploit code is available, or an exploit is theoretical.

Remediation Level (RL)

The Remediation Level of a vulnerability is an important factor for prioritization.

• Not Defined (X): Assigning this value indicates there is insufficient information to choose one of the other values, and has no impact on the overall Temporal Score, i.e., it has the same effect on scoring as assigning Unavailable.
• Unavailable (U): There is either no solution available or it is impossible to apply.
• Workaround (W): There is an unofficial, non-vendor solution available.
• Temporary Fix (T): There is an official but temporary fix available.
• Official Fix (O): A complete vendor solution is available.

Report Confidence (RC)

This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.

• Not Defined (X): Assigning this value indicates there is insufficient information to choose one of the other values, and has no impact on the overall Temporal Score, i.e., it has the same effect on scoring as assigning Confirmed.
• Confirmed (C): Detailed reports exist, or functional reproduction is possible (functional exploits may provide this).
• Reasonable (R): Significant details are published, but researchers either do not have full confidence in the root cause, or do not have access to source code to fully confirm all of the interactions that may lead to the result.
• Unknown (U): There are reports of impacts that indicate a vulnerability is present.

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user's organization, measured in terms of Confidentiality, Integrity, and Availability.

Confidentiality Requirement (CR)

• Not Defined (X): Assigning this value indicates there is insufficient information to choose one of the other values, and has no impact on the overall Environmental Score, i.e., it has the same effect on scoring as assigning Medium.
• High (H): Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Medium (M): Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Low (L): Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Integrity Requirement (IR)

• Not Defined (X): Assigning this value indicates there is insufficient information to choose one of the other values, and has no impact on the overall Environmental Score, i.e., it has the same effect on scoring as assigning Medium.
• High (H): Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Medium (M): Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Low (L): Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Availability Requirement (AR)

• Not Defined (X): Assigning this value indicates there is insufficient information to choose one of the other values, and has no impact on the overall Environmental Score, i.e., it has the same effect on scoring as assigning Medium.
• High (H): Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Medium (M): Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
• Low (L): Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).