CVSS

Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. It is under the custodianship of NIST.^[1] It attempts to establish a measure of how much concern a vulnerability warrants, compared to other vulnerabilities, so efforts can be prioritized. The scores are based on a series of measurements (called metrics) based on expert assessment. The scores range from 0 to 10. Vulnerabilities with a base score in the range 7.0-10.0 are High, those in the range 4.0-6.9 as Medium, and 0-3.9 as Low.^[2]

History

Research by the National Infrastructure Advisory Council in 2003/2004 lead to the launch of CVSSv1 in 2004. This initial draft had not been subject to peer review or review by multiple organisations. Work on CVSSv2 (the current version) began in 2005 and launched in 2007. Work on version 3 began^[3] in 2012, and is expected to be released in late 2015.

Usage

The CVSSv2 base score has been adopted as primary method for quantifying the severity of vulnerabilities by a wide range of organisations and companies, including:

the National Vulnerability Database (NVDB)^[4]
the Open Source Vulnerability Database (OSVDB)^[5]
Qualys^[6] (offers CVSSv2 as a secondary optional scoring)
Cisco^[7]

Metrics

The CVSS assessment measures three areas of concern:

Base Metrics for qualities intrinsic to a vulnerability
Temporal Metrics for characteristics that evolve over the lifetime of vulnerability
Environmental Metrics for vulnerabilities that depend on a particular implementation or environment

These metrics are used to generate a numerical score and a text vector that indicates the severity of the vulnerability, and the way in which it was calculated.

Base

Exploitability

Access Vector

The access vector (AV) shows how a vulnerability may be exploited.

Value	Description	Score
Local (L)	The attacker must either have physical access to the vulnerable system (e.g. firewire attacks) or a local account (e.g. a privilege escalation attack).	0.395
Adjacent Network (A)	The attacker must have access to the broadcast or collision domain of the vulnerable system (e.g. ARP spoofing, bluetooth attacks).	0.646
Network (N)	The vulnerable interface is working at layer 3 or above of the OSI Network stack. These types of vulnerabilities are often described as remotely exploitable (e.g. a remote buffer overflow in a network service)	1.0

Access Complexity

The access complexity (AC) metric describes how easy or difficult it is to exploit the discovered vulnerability.

Value	Description	Score
High (H)	Specialised conditions exist, such as a race condition with a narrow window, or a requirement for social engineering methods that would be readily noticed by knowledgeable people.	0.35
Medium (M)	There are some additional requirements for access, such as a limit on the origin of the attacks, or a requirement for the vulnerable system to be running with an uncommon, non-default configuration.	0.61
Low (L)	There are no special conditions for access to the vulnerability, such as when the system is available to large numbers of users, or the vulnerable configuration is ubiquitous.	0.71

Authentication

The authentication (Au) metric describes the number of times that an attacker must authenticate to a target to exploit it. It does not include (for example) authentication to a network in order to gain access. For locally exploitable vulnerabilities, this value should only be set to Single or Multiple if further authentication is required after initial access.

Value	Description	Score
Multiple (M)	Exploitation of the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time.	0.45
Single (S)	The attacker must authenticate once in order to exploit the vulnerability.	0.56
None (N)	There is no requirement for the attacker to authenticate.	0.704

Impact metrics

Confidentiality

The confidentiality (C) metric describes the impact on the confidentiality of processed by the system.

Value	Description	Score
None (N)	There is no impact on the confidentiality of the system.	0.0
Partial (P)	There is considerable disclosure of information, but the scope of the loss is constrained such that not all of the data is available.	0.275
Complete (C)	There is total information disclosure, providing access to any / all data on the system.	0.660

Integrity

The Integrity (I) metric describes the impact on the integrity of the exploited system.

Value	Description	Score
None (N)	There is no impact on the integrity of the system.	0.0
Partial (P)	Modification of some data or system files is possible, but the scope of the modification is limited.	0.275
Complete (C)	There is total loss of integrity; the attacker can modify any files or information on the target system.	0.660

Availability

The availability (A) metric describes the impact on the availability of the target system. Attacks that consume network bandwidth, processor cycles, memory or any other resources affect the availability of a system.

Value	Description	Score
None (N)	There is no impact on the availability of the system.	0.0
Partial (P)	There is reduced performance or loss of some functionality.	0.275
Complete (C)	There is total loss of availability of the attacked resource.	0.660

Calculations

These six metrics are used to calculate the exploitability and impact sub-scores of the vulnerability. These sub-scores are used to calculate the overall base score.

$\begin{align} Exploitability = {{{20}}} \times {{{AccessVector}}}\times{{{AccessComplexity}}}\times{{{Authentication}}} \\ \end{align}$

$\begin{align} Impact = {{{10.41}}} \times (1-(1-ConfImpact) \times (1-IntegImpact) \times (1-AvailImpact)) \\ \end{align}$

$f(Impact) = \begin{cases} 0, & \text{if }Impact\text{ = 0} \\ 1.176, & \text{otherwise } \end{cases}$

$\begin{align} BaseScore = {{{roundTo1Decimal}}}( ((0.6 \times Impact) +(0.4 \times Exploitability)-1.5) \times f(Impact)) \end{align}$

The metrics are concatenated to produce the CVSS Vector for the vulnerability.

Example

A buffer overflow vulnerability affects web server software that allows a remote user to gain partial control of the system, including the ability to cause it to shut down:

Metric	Value	Description
Access Vector	Network	The vulnerability may be accessed from any network that can access the target system - typically the whole of the internet
Access Complexity	Low	There are no special requirements for access
Authentication	None	There is no requirement for authentication in order to exploit the vulnerability
Confidentiality	Partial	The attacker can read some files and data on the system
Integrity	Partial	The attacker can alter some files and data on the system
Availability	Complete	The attacker can cause the system and web service to become unavailable / unresponsive by shutting the system down

This would give an exploitability sub-score of 10, and an impact sub-score of 8.5, giving an overall base score of 9.0. The vector for the base score in this case would be AV:N/AC:L/Au:N/C:P/I:P/A:C. The score and vector are normally presented together to allow the recipient to fully understand the nature of the vulnerability and to calculate their own environmental score if necessary.

Temporal Metrics

The value of temporal metrics change over the lifetime of the vulnerability, as exploits are developed, disclosed and automated and as mitigations and fixes are made available.