CVSSScores

CVSSScores are numeric representations of vulnerability severity derived from the Common Vulnerability Scoring System (CVSS). They provide a standardized, quantitative measure to compare vulnerabilities and guide remediation priorities.

CVSS defines three metric groups: base, temporal, and environmental. The base score reflects intrinsic vulnerability characteristics, such as access vector, access complexity, privileges required, user interaction, scope, and impacts on confidentiality, integrity, and availability. The temporal score accounts for factors that change over time, including exploitability, existence of a workaround, and confidence. The environmental score adapts the base and temporal scores to a specific environment by considering affected assets and security requirements. The final CVSS Score is on a scale from 0.0 to 10.0 and is typically associated with a severity label (None, Low, Medium, High, Critical). CVSS vectors encode the measured factors in a string, enabling tool-based reconstruction of the score.

CVSS has versions, notably CVSS v2, CVSS v3.x, and CVSS v4.0. Each version modifies metric definitions and scoring formulas, which can yield different scores for the same vulnerability across versions. CVSS scores are published by vulnerability databases and advisories and are used in risk management, prioritization, and reporting.

Limitations: CVSSScores describe vulnerability characteristics rather than actual risk, and do not account for exploit prevalence, asset criticality, or compensating controls. They should be applied with local context in mind and used in combination with broader risk assessment practices to drive remediation decisions.

---