Question 1

What is a CVSS score?

Accepted Answer

A CVSS (Common Vulnerability Scoring System) score is a numerical value from 0.0 to 10.0 that represents the severity of a security vulnerability. It is maintained by FIRST.org and used by organizations worldwide to prioritize vulnerability remediation. The score considers factors like attack vector, complexity, required privileges, and potential impact on confidentiality, integrity, and availability.

Question 2

What is the difference between CVSS 3.1 and CVSS 4.0?

Accepted Answer

CVSS 4.0, released in November 2023, replaces the Scope metric from v3.1 with separate Vulnerable System and Subsequent System impact metrics. It also adds Attack Requirements (AT) and splits User Interaction into None, Passive, and Active. CVSS 4.0 uses a lookup-table scoring approach instead of the formula used in v3.1, which reduces scoring inconsistencies across assessors.

Question 3

How do I calculate a CVSS 3.1 base score?

Accepted Answer

Select values for all eight base metrics: Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), Scope (S), Confidentiality (C), Integrity (I), and Availability (A). The calculator applies the official FIRST.org formula to produce a score from 0.0 to 10.0 along with a severity rating from None to Critical.

Question 4

How do I calculate a CVSS 4.0 base score?

Accepted Answer

Select values for all eleven base metrics across three groups: Exploitability (AV, AC, AT, PR, UI), Vulnerable System Impact (VC, VI, VA), and Subsequent System Impact (SC, SI, SA). The calculator uses the official MacroVector lookup table from the FIRST.org CVSS 4.0 specification to determine the score.

Question 5

Should I use CVSS 3.1 or CVSS 4.0?

Accepted Answer

CVSS 4.0 is the latest version and recommended by FIRST.org for new assessments. However, many organizations and vulnerability databases (such as NVD) still use CVSS 3.1 scores. If your organization or compliance framework specifies a version, use that. Otherwise, consider scoring in both versions during the transition period.

Question 6

What do the CVSS severity ratings mean?

Accepted Answer

CVSS severity ratings map score ranges to qualitative labels: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). These ratings help teams quickly triage vulnerabilities. Critical and High severity findings typically require immediate remediation, while Medium and Low findings can be scheduled based on organizational risk tolerance.

Question 7

Can I share my CVSS calculation with others?

Accepted Answer

Yes. This calculator syncs the vector string and version to the URL. Copy the browser URL to share exact scores with your team. You can also copy the vector string directly and paste it into vulnerability reports, ticketing systems, or security tools.

Question 8

Is this calculator accurate?

Accepted Answer

Yes. The CVSS 3.1 calculator implements the official formula from the FIRST.org specification. The CVSS 4.0 calculator uses the official MacroVector lookup table and interpolation algorithm from the FIRST.org reference implementation. Both produce scores identical to the official FIRST.org calculators.

CVSS 3.1 & 4.0 Calculator
score any vulnerability instantly

Related features

Vulnerability management software that tracks every finding

Cybersecurity risk assessment

Penetration testing

Need CVSS scoring in your workflow?

CVSS 3.1 & 4.0 Calculatorscore any vulnerability instantly