CVSS

From Wikipedia, the free encyclopedia

You have new messages (last change).

Common Vulnerability Scoring System (CVSS) is an industry standard for assessing the severity of computer system security vulnerabilities. It attempts to establish a measure of how much concern a vulnerability warrants, compared to other vulnerabilites, so efforts can be prioritized. The score is based on a series of measurements (called metrics) based on expert assessment.

Contents

[edit] Metrics

The CVSS assessment measures three areas of concern:

  1. Base Metrics for qualities intrinsic to a vulnerability.
  2. Temporal Metrics for characteristics that evolve over the lifetime of vulnerability.
  3. Environmental Metrics for characteristics of a vulnerability that depend on a particular implementation or environment.

[edit] Base Metrics

  1. Is the vulnerability exploitable remotely (as opposed to only locally).
  2. How complex must an attack be to exploit the vulnerability?
  3. Is authentication required to attack?
  4. Does the vulnerabilty expose confidential data?
  5. Can attacking the vulnerability damage the integrity of the system?
  6. Does it impact availability of the system?

[edit] Temporal Metric

  1. How complex (or how long will it take) to exploit the vulnerability.
  2. How hard (or how long) will it take to remediate the vulnerability.
  3. How certain is the vulnerability's existence.

[edit] Environmental Metric

  1. Potential to cause collateral damage.
  2. How many systems (or how much of a system) does the vulnerability impact.

[edit] External links

Retrieved from "http://en.wikipedia.org../../../c/v/s/CVSS_b721.html"