The CVSS Score System

Cyver Core implements the CVSS or “Common Vulnerability Scoring System”. You can set this score when uploading, importing, or editing a Finding. 

The CVSS Score is a numerical (0.0-10.0) value, representing the severity of a Finding. In most cases, it’s used to help clients prioritize remediation. CVSS scores are based on different sets of metrics (such as Base, Temporal/Threat, and Environmental). Each uses its own scoring component.

Below is a breakdown of the supported CVSS versions and the scores and metrics calculated for each.

CVSS 4.0

• Base: Represent the intrinsic characteristics of a vulnerability.

  • EXPLOITABILITY METRICS: Attack Vector, Attack Complexity, Attack Requirements, Privileges Required, User Interaction.

  • VULNERABLE SYSTEM IMPACT: Confidentiality, Integrity, Availability.

  • SUBSEQUENT SYSTEM IMPACT: Confidentiality, Integrity, Availability.

• Threat (Optional): Replaces the legacy "Temporal" metrics. Reflects characteristics that may change over time.

  • Exploit Maturity.

• Environmental (Optional): Adapts the score to a specific environment.

  • EXPLOITABILITY METRICS: Modified Attack Vector, Modified Attack Complexity, Modified Attack Requirements, Modified Privileges Required, Modified User Interaction.

  • VULNERABLE SYSTEM IMPACT: Modified Confidentiality, Modified Integrity, Modified Availability.

  • SUBSEQUENT SYSTEM IMPACT: Modified Confidentiality, Modified Integrity, Modified Availability.

  • SECURITY REQUIREMENTS: Confidentiality Requirement, Integrity Requirement, Availability Requirement.

• Supplemental (Optional): Provides additional context without modifying the numerical score.

  • Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort, Provider Urgency.

CVSS 3.1

• Base: Define the characteristics of a vulnerability that remain static over time.

  • EXPLOITABILITY METRICS: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope.

  • IMPACT METRICS: Confidentiality Impact, Integrity Impact, Availability Impact.

• Temporal (Optional): Track how vulnerabilities change over time.

  • Exploit Code Maturity, Remediation Level, Report Confidence.

• Environmental (Optional): Update base and temporal metrics based on security requirements for the asset or organization.

  • MODIFIED REQUIREMENT (IMPACT SUBSCORE) MODIFIERS: Confidentiality Requirement, Integrity Requirement, Availability Requirement.

  • EXPLOITABILITY METRICS: Modified Attack Vector, Modified Attack Complexity, Modified Privileges Required, Modified User Interaction, Modified Scope.

  • MODIFIED IMPACT: Confidentiality Impact, Integrity Impact, Availability Impact.

CVSS 3.0

• Base:

  • EXPLOITABILITY METRICS: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope.

  • IMPACT METRICS: Confidentiality Impact, Integrity Impact, Availability Impact.

• Temporal (Optional):

  • Exploit Code Maturity, Remediation Level, Report Confidence.

• Environmental (Optional):

  • MODIFIED REQUIREMENT (IMPACT SUBSCORE) MODIFIERS: Confidentiality Requirement, Integrity Requirement, Availability Requirement.

  • EXPLOITABILITY METRICS: Modified Attack Vector, Modified Attack Complexity, Modified Privileges Required, Modified User Interaction, Modified Scope.

  • MODIFIED IMPACT: Confidentiality Impact, Integrity Impact, Availability Impact.

CVSS 2.0

• Base:

  • EXPLOITABILITY METRICS: Access Vector, Access Complexity, Authentication.

  • IMPACT METRICS: Confidentiality Impact, Integrity Impact, Availability Impact.

• Temporal (Optional):

  • Exploitability, Remediation Level, Report Confidence.

• Environmental (Optional):

  • GENERAL MODIFIERS: Collateral Damage Potential, Target Distribution.

  • MODIFIED REQUIREMENT (IMPACT SUBSCORE) MODIFIERS: Confidentiality Requirement, Integrity Requirement, Availability Requirement.

Ideally, CVSS scores are set based on the organization in question, helping Clients to see which Findings they should prioritize for remediation. CVSS scores are used in the dashboard and in the Threat Risk Profile for each client. Click here for the CVSS 3.1 Scoring Calculator by First.org