CVSS Calculator (v4.0 / v3.1)

About the CVSS Calculator (v4.0 / v3.1)

The Common Vulnerability Scoring System (CVSS), maintained by FIRST, turns the characteristics of a vulnerability into a score from 0.0 to 10.0 and a rating from None to Critical. This calculator scores CVSS 4.0, 3.1 and 3.0 vectors, and CVSS 2.0 for legacy records: choose each metric, or paste a vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and every picker is set from it. The line under each metric says what the chosen value means, paraphrasing the specification, and the vector is rebuilt in the order the specification requires as you choose.

Besides the base score it scores the threat (CVSS 4.0) or temporal (3.x, 2.0) metrics and the environmental metrics that fit a score to your own systems, shows the CVSS 4.0 MacroVector and nomenclature (CVSS-B, CVSS-BT, CVSS-BE, CVSS-BTE) and the 3.x and 2.0 subscores, and works each score out step by step with the specification’s weights. CVSS 3.x and 4.0 are scored with a port of FIRST’s reference calculators, and CVSS 2.0 in exact decimal arithmetic, so the rounding follows the specifications. Everything runs in your browser.

Without a pass you see a free preview: the base score and its rating in full, with the first step of the working; the threat, temporal and environmental scores, the subscores and the rest of the working, the copied summary and the Markdown and JSON reports unlock with a Pro pass. The vector and its link hold only your own choices, so they never need one.

Common uses

• Scoring a finding for a penetration-test report, a bug-bounty submission or a vendor advisory.
• Checking a score published by a vendor or in a vulnerability database against its vector.
• Adjusting a published base score to your own environment before you prioritise patching.
• Translating between versions: reading an old CVSS 2.0 record next to the CVSS 3.1 or 4.0 score of the same vulnerability.
• Learning how each metric moves the score, with the working shown step by step.

The rating scale

CVSS 4.0, 3.1 and 3.0 share one qualitative scale: None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0. CVSS 2.0 has no scale of its own; vulnerability databases such as NVD rate its scores Low (0.0–3.9), Medium (4.0–6.9) and High (7.0–10.0), and this calculator does the same, so a CVSS 2.0 score of 9.3 is High, not Critical.

How each version works the score out

• CVSS 4.0 sorts the vector into a MacroVector of six equivalence sets (EQ1 to EQ6: exploitability, complexity, impact on the vulnerable system, on subsequent systems, exploit maturity, and security requirements with impact). FIRST’s lookup table gives the score of the most severe vectors in that MacroVector, and the vector’s own score is that score lowered by how far its metrics sit from those vectors.
• CVSS 3.1 and 3.0 combine an impact subscore (from confidentiality, integrity and availability, and whether the scope changes) with an exploitability subscore (8.22 × attack vector × complexity × privileges × user interaction) and round up to one decimal. CVSS 3.1 defines the rounding with integer arithmetic so that floating-point error cannot add a tenth.
• CVSS 2.0 uses Base = round(((0.6 × Impact) + (0.4 × Exploitability) − 1.5) × f(Impact)), with temporal and environmental equations on top.

Open How the score is worked out under the calculator to follow your own vector through these steps.

CVSS-B, CVSS-BT, CVSS-BE and CVSS-BTE

CVSS 4.0 asks that every score names the metric groups behind it: CVSS-B for the base metrics alone, CVSS-BT with threat metrics, CVSS-BE with environmental metrics and CVSS-BTE with both. Vendors and databases usually publish only the CVSS-B score; threat and environmental metrics are for the people who use the score. The calculator shows the label of your vector beside its score, and the CVSS-B score separately when your vector includes more.

What changed from CVSS 3.1 to 4.0

• Scope is gone: impact is scored for the vulnerable system (VC, VI, VA) and for subsequent systems beyond it (SC, SI, SA).
• Attack Requirements (AT) is new: conditions of the deployment that an attack depends on, apart from the defences that Attack Complexity covers.
• User Interaction has three values: None, Passive and Active.
• The temporal group became Threat, with only Exploit Maturity (Attacked, POC, Unreported); Remediation Level and Report Confidence were retired.
• A new Supplemental group (Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort, Provider Urgency) adds context but never changes the score.
• Modified subsequent-system integrity and availability (MSI, MSA) can be Safety, for harm to people.

Sources

• CVSS v4.0 Specification Document and CVSS v4.0 examples — FIRST
• CVSS v3.1 Specification Document — FIRST
• A Complete Guide to the Common Vulnerability Scoring System Version 2.0 — FIRST
• FIRST’s CVSS v4.0 reference calculator, whose method the 4.0 scores follow

Limitations

• A CVSS score measures the severity of a vulnerability, not the risk it poses to you: FIRST’s user guide says CVSS should not be used alone to assess risk. Weigh it with what you know about the exposure and value of the affected systems.
• The calculator scores the metrics you choose; it does not decide them. Two people scoring the same flaw can disagree, especially on Attack Complexity, Attack Requirements and the subsequent-system impacts.
• Supplemental metrics are kept in the vector but, as the specification says, never change the score.
• In CVSS 2.0 a few combinations of low impact and low requirements make the guide’s equation give an adjusted base score below 0.0; the calculator shows such a score as 0.0 and says so.
• CVSS 3.0 vectors are scored with the CVSS 3.0 formulas: their temporal and environmental scores can differ from CVSS 3.1 by a tenth (the rounding and the changed-scope environmental formula differ).

Privacy

On this device: nothing is sent

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.