CVSSskalor

CVSSskalor is a term used to describe the scales or metrics within the Common Vulnerability Scoring System (CVSS) that are used to rate the severity of software vulnerabilities. The concept emphasizes that vulnerability severity is derived from multiple factors organized into distinct metric groups, which together produce a single numeric score and a qualitative severity label.

Base metrics capture the inherent characteristics of a vulnerability. They consider how it can be exploited (Attack Vector and Attack Complexity), what privileges an attacker must have (Privileges Required), whether user interaction is needed, and whether the vulnerability affects a broader scope. They also measure potential impact on confidentiality, integrity, and availability. The combination of these metrics yields the base score, typically on a scale from 0.0 to 10.0.

Temporal metrics reflect factors that can change over time. They include how easily the vulnerability can be exploited (Exploitability), whether there are known mitigations or workarounds (Remediation Level), and the confidence in the reported information (Report Confidence). Applying temporal metrics adjusts the base score to produce a temporal score.

Environmental metrics tailor scores to a specific environment. They allow weighting of security requirements for confidentiality, integrity, and availability and enable the use of modified impact values to reflect installed controls or where an asset operates within a particular risk posture. The environmental score helps organizations prioritize vulnerabilities within their own context.

CVSS scales yield a numeric score and a qualitative severity category, typically None, Low, Medium, High, and Critical, mapped to score ranges. The CVSS framework is maintained by FIRST and is widely used in vulnerability management to support consistent prioritization and comparison across products and incidents. CVSS has several versions, notably CVSS 2.x and CVSS 3.x, which differ in metric definitions and scoring details.