Cvss

A Complete Guide to the Common Vulnerability Scoring System Version 2.0
June, 2007

Peter Mell, Karen Scarfone National Institute of Standards and Technology

Sasha Romanosky Carnegie Mellon University

Acknowledgements: The authors sincerely wish to recognize the contributions of all of the CVSS Special Interest Group members, including Barrie Brook, Seth Hanford, Stav Raviv, Gavin Reid,George Theall and Tadashi Yamagishi as well as the authors of the CVSS v1.0 standard [1].

The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and impacts of IT vulnerabilities. CVSS consists of three groups: Base, Temporal and Environmental. Each group produces a numeric score ranging from 0 to 10, and a Vector, a compressed textualrepresentation that reflects the values used to derive the score. The Base group represents the intrinsic qualities of a vulnerability. The Temporal group reflects the characteristics of a vulnerability that change over time. The Environmental group represents the characteristics of a vulnerability that are unique to any user’s environment. CVSS enables IT managers, vulnerability bulletin providers,security vendors, application vendors and researchers to all benefit by adopting this common language of scoring IT vulnerabilities.

Common Vulnerability Scoring System (v2)

-1-

Table of Contents
1 Introduction .......................................................................................................................................... 3 1.1 What is CVSS?............................................................................................................................ 3 1.2 Other vulnerability scoring systems ............................................................................................ 4 1.3 How does CVSS work? ............................................................................................................... 4 1.4 Who performsthe scoring?.......................................................................................................... 5 1.5 Who owns CVSS? ....................................................................................................................... 5 1.6 Who is using CVSS? ...................................................................................................................5 1.7 Quick definitions ......................................................................................................................... 6 Metric Groups ...................................................................................................................................... 6 2.1 Base Metrics................................................................................................................................ 6 2.1.1 Access Vector (AV) ................................................................................................................ 7 2.1.2 Access Complexity (AC) ........................................................................................................ 7 2.1.3 Authentication (Au)................................................................................................................ 8 2.1.4 Confidentiality Impact (C) ...................................................................................................... 8 2.1.5 Integrity Impact (I) .................................................................................................................. 9 2.1.6 Availability Impact (A)........................................................................................................... 9 2.2 Temporal Metrics ...................................................................................................................... 10 2.2.1 Exploitability (E)...................................................................................................................10 2.2.2 Remediation Level...