thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Common Vulnerability Scoring System (CVSS)

An open standard for rating the severity of vulnerabilities on a 0.0 to 10.0 scale, maintained by FIRST.

Definition

CVSS v4.0 (released 2023) uses Base, Threat, Environmental and Supplemental metric groups; v3.1 uses Base, Temporal and Environmental. Base metrics include attack vector, attack complexity, privileges required, user interaction and impact on confidentiality, integrity and availability. Severity bands are None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9 and Critical 9.0-10.0.

Example

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8 Critical.

Exam tip

Know the vector string abbreviations and severity ranges; CVSS measures severity, not risk to your specific organization.

Don't confuse it with

Related terms