CVSS

Common Vulnerability Scoring System (CVSS) is an industry standard for assessing the severity of computer system security vulnerabilities. It attempts to establish a measure of how much concern a vulnerability warrants, compared to other vulnerabilities, so efforts can be prioritized. The score is based on a series of measurements (called metrics) based on expert assessment.

Contents

Metrics

The CVSS assessment measures three areas of concern:

  1. Base Metrics for qualities intrinsic to a vulnerability.
  2. Temporal Metrics for characteristics that evolve over the lifetime of vulnerability.
  3. Environmental Metrics for characteristics of a vulnerability that depend on a particular implementation or environment.

Base Metrics

  1. Is the vulnerability exploitable remotely (as opposed to only locally).
  2. How complex must an attack be to exploit the vulnerability?
  3. Is authentication required to attack?
  4. Does the vulnerability expose confidential data?
  5. Can attacking the vulnerability damage the integrity of the system?
  6. Does it impact availability of the system?

Temporal Metrics

  1. How complex (or how long will it take) to exploit the vulnerability.
  2. How hard (or how long) will it take to remediate the vulnerability.
  3. How certain is the vulnerability's existence.

Environmental Metrics

  1. Potential to cause collateral damage.
  2. How many systems (or how much of a system) does the vulnerability impact.
  3. Security Requirement(CIA)

See also

External links