Common Vulnerability Scoring System (CVSS) - Complete Guide for Security Professionals

Jun 20, 2025    #cvss   #security   #vulnerability-assessment   #penetration-testing   #security-scoring   #risk-assessment   #cybersecurity   #security-metrics   #first   #nist  

Introduction:

The Common Vulnerability Scoring System (CVSS) is an industry standard for assessing and communicating the severity of security vulnerabilities. This guide serves as both a comprehensive reference for security professionals and a practical tool for penetration testers.

What is CVSS?

CVSS provides a standardized way to score vulnerabilities on a scale of 0.0 to 10.0, where 10.0 represents the most severe vulnerabilities. The system is maintained by the Forum of Incident Response and Security Teams (FIRST) and is widely adopted across the cybersecurity industry.

As penetration testers we typically use CVSS scorings to justify our findings and apply an appropriate score to them.

CVSS Version Information

This guide covers CVSS v3.1, the current standard. CVSS v2 is deprecated but may still be encountered in legacy systems & v4 is still not widely adopted as of yet.

CVSS Score Ranges:

CVSS scores will fall into 1 of 5 scoring categories.

CVSS Scoring Tools:

There are multiple tools out there that can be used generate CVSS scores, below are just a few examples.

I have generated one myself which is available below, and also at https://bloodstiller.com/tools/cvss-calculator/

Official Tools:

Third-Party Tools:

Quick Reference Cheat Sheet:

Base Score Metrics Quick Reference:

Sometimes when scoring the different metrics can overwhelming so here is a simple quick reference.

Metric Values Description
Attack Vector Network, Adjacent, Local, Physical Where the attacker needs to be
Attack Complexity Low, High How difficult the attack is to execute
Privileges Required None, Low, High What access the attacker needs
User Interaction None, Required Whether user action is needed
Scope Changed, Unchanged Whether other systems are affected
Confidentiality None, Low, High Impact on data confidentiality
Integrity None, Low, High Impact on data integrity
Availability None, Low, High Impact on system availability

Metrics Explained:

Base Score Metrics:

This is the only metric we have to fill out to get a score as penetration testers. The Base Score represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments.

Exploitability Metrics:

Attack Vector (AV):

This is where in space & relation to the target the attacker needs to be to perform the attack.

Attack Complexity:

This is used to gauge the complexity of the attack.

Privileges Required:

These are the privileges required before the attack, e.g. what privileges the attacker needs to perform the attack.

+Note+: This can be complex. If the attack is against a webhost with a registration page to create an account, this would not be classed as “low” but instead “none” as the attacker had no privileges and then was able to generate privileges to perform the attack.

User Interaction:

Whether the victim has to be an active participant in the attack.

Scope:

Does this affect another application other than the one being attacked?

+Note+: This sometimes requires educated guesswork when making a score as often as testers we will have no direct insight into if the attack on HOST A effects HOST B.

Impact Metrics:

These represent the CIA triad and score the impact of the vulnerability on them.

Confidentiality Impact:
Integrity Impact:
Availability Impact:

Temporal Score Metrics:

These metrics reflect how vulnerability severity changes over time. They can be added later if needed but are not required for basic scoring.

Exploit Code Maturity:

This indicates whether exploit code exists for this vulnerability:

Remediation Level:

Has the vendor fixed it and in what way:

Report Confidence:

Not commonly used in penetration testing:

Environmental Score Metrics:

As penetration testers, we typically don’t modify Environmental Score Metrics as we don’t have complete knowledge of the environment. These are usually adjusted by the organization receiving the assessment.

The Environmental metrics mirror the Base Score Metrics, allowing organizations to adjust scores based on their specific environment. For example:

What is a CVSS Vector String?

A CVSS vector string is a compact, standardized text representation of all the metrics used to calculate a CVSS score. It looks like this.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Each part after the version number (CVSS:3.1) defines a specific metric, such as how the vulnerability is accessed (AV:N = network), or how much user interaction is required (UI:N = none).

The vector string is “formula” behind the score, as it records the exact combination of conditions and impacts that led to a given score.

Reversible and Consistent:

One of the key features of CVSS vectors is that they are reversible and consistent. This means that if someone plugs the exact same vector into a CVSS calculator, they will always get the same score and severity. This ensures repeatability and transparency when sharing or comparing vulnerability assessments.

A good way to think about this is like a hashing algorithm. If you take the string “hello world” and run it through a SHA-256 hash function, you’ll always get the same result, and so will everyone else, anywhere in the world. Similarly, a CVSS vector string is a standard representation that, when used, always produces the same score, regardless of who calculates it.

+Note+: Unlike hashes, CVSS vectors are also readable and can be “reversed” to see the exact conditions that produced the score.

Many different vector strings can exist, each describing different combinations of metrics & these will naturally produce different scores and severities.

For example, a vulnerability requiring local access and user interaction will score lower than one exploitable remotely with no user interaction, even if they both affect the same system.

So while a vector string will always map to one unique score, there are countless valid vectors, each representing different scenarios.

Some Examples Of CVSS Vector Strings:

Practical Examples:

Example 1: SQL Injection Vulnerability:

Scenario: A web application has a SQL injection vulnerability in the login form that allows an attacker to bypass authentication and access the admin panel.

Scoring:

CVSS Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Example 2: Stored XSS Vulnerability:

Scenario: A comment system allows users to post HTML that gets stored and displayed to other users, potentially stealing their session cookies.

Scoring:

CVSS Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Common Pitfalls & How to Avoid Them:

1. Confusing Attack Vector with Attack Complexity:

2. Over-scoring Privileges Required:

3. Misunderstanding Scope:

4. Inconsistent Impact Scoring:

5. Ignoring User Interaction:

Step-by-Step Walkthrough

Walkthrough: Scoring a Buffer Overflow Vulnerability

Let’s score a buffer overflow vulnerability in a network service:

  1. Attack Vector: Network (accessible over network)
  2. Attack Complexity: Low (standard buffer overflow techniques)
  3. Privileges Required: None (no authentication needed)
  4. User Interaction: None (no user action required)
  5. Scope: Unchanged (only affects this service)
  6. Confidentiality: High (can read arbitrary memory)
  7. Integrity: High (can modify arbitrary memory)
  8. Availability: High (can crash the service)

Result:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Walkthrough: Scoring a Local Privilege Escalation

Let’s score a local privilege escalation vulnerability:

  1. Attack Vector: Local (requires local access)
  2. Attack Complexity: Low (simple exploit)
  3. Privileges Required: Low (normal user account)
  4. User Interaction: None (no additional user action)
  5. Scope: Unchanged (only affects this system)
  6. Confidentiality: High (access to all data)
  7. Integrity: High (can modify any data)
  8. Availability: High (can control the system)

Result:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Troubleshooting

External Resources

Official Documentation:

Learning Resources:

Tools and Calculators


Next: Understanding PowerShell Download Cradles: A Deep Dive