CVSS v3.1 Calculator

These vectors show how the metrics move the score. A flaw that anyone on the internet can exploit without logging in and that gives full control scores 9.8; if it also breaks out of the vulnerable component (scope changed), it reaches the maximum of 10.0. Requiring the victim to click a link and limiting the damage, as in a typical cross-site scripting bug, brings the score down to the Medium range.

Exploitability metrics describe how the vulnerability is attacked. Attack Vector says from where: Network (over the internet), Adjacent (same local network or Bluetooth range), Local (needs a session on the machine) or Physical. Attack Complexity is High when success depends on conditions the attacker does not control, such as winning a race. Privileges Required is the access the attacker needs beforehand, and User Interaction is Required when a victim must do something, like open a file. Scope is Changed when the attack affects components beyond the vulnerable one, for example escaping a sandbox or a virtual machine. Confidentiality, Integrity and Availability rate the damage: None, Low (some data or some disruption) or High (everything).

The calculator follows section 7 of the specification. The impact sub-score combines the three impact metrics; the exploitability sub-score is 8.22 times the product of the attack vector, complexity, privileges and interaction weights. Privileges Required weighs more when the scope is changed. The base score adds the two sub-scores (times 1.08 when the scope is changed), caps the sum at 10 and rounds it up to one decimal with the specification's Roundup function, which avoids small floating-point errors. If the impact is zero, the score is 0.0 whatever the exploitability.

The temporal metrics change over time. Exploit Code Maturity lowers the score while no working exploit is known, Remediation Level lowers it once an official fix or a workaround exists, and Report Confidence lowers it when the report is unconfirmed. For example, the 9.8 vector above with unproven exploit code (E:U) and an official fix (RL:O) has a temporal score of 8.5. The environmental metrics let you rate the vulnerability for your own systems: raise the confidentiality, integrity or availability requirement for critical systems, or override a base metric that differs in your setup. If the vulnerable service is only reachable locally in your network (MAV:L), the same 9.8 vector has an environmental score of 8.4.

CVSS measures technical severity, not the risk to your organisation. A 9.8 on a system that is switched off and isolated may matter less than a 6.5 on your public login page. Use the score to compare vulnerabilities and set a first priority, then consider exposure, the value of the data, compensating controls and whether the flaw is being exploited in the wild, for example in the CISA Known Exploited Vulnerabilities catalogue.