CVSS 3.1 calculator
Pick the metrics for a vulnerability or paste a vector from an advisory or the NVD, and the tool instantly works out the CVSS 3.1 score, the severity and a vector you can copy.
How to use it
- If you have a vector from a vendor advisory or the NVD (starting CVSS:3.1/ or CVSS:3.0/), paste it into the box and click Load vector.
- Otherwise, set the base metrics from the vulnerability description – where the attack can come from, what the attacker needs and what the impact is.
- Optionally add the temporal metrics: whether an exploit exists, whether there's a fix, and how reliable the report is.
- To score for your own environment, set the environmental metrics: how much the affected system matters to you (CR, IR, AR) and what's different in your setup – for example, the device isn't reachable from the internet (MAV).
- The score and vector update after every change. Copy the vector into a ticket or report – the page address contains it too.
How it works
CVSS (the Common Vulnerability Scoring System) scores appear in vendor advisories, the NVD and national CERT warnings. A number from 0 to 10 sums up how easy a flaw is to exploit and what an attacker gains. This calculator uses CVSS version 3.1, maintained by FIRST:
- Base score – properties of the flaw that don't change over time: attack vector, complexity, privileges required, user interaction, scope, and the impact on confidentiality, integrity and availability.
- Temporal score – the things that do change: whether a working exploit exists, whether a fix is available and how reliable the report is. It can never exceed the base score.
- Environmental score – tailors the result to your organisation: how important the affected system is and what's different in your setup, such as a vulnerable service that isn't exposed to the internet. Useful when you need to rank flaws by what they mean for you specifically.
- Severity, using the rating table in the specification: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0).
The result also shows the impact and exploitability subscores that make up the base score, which helps when you compare your assessment with a vendor's or the NVD's.
FAQ
Is anything sent to a server?
No. The score is calculated by a script in your browser using the formulas from the CVSS 3.1 specification, and nothing is sent or stored. The vector is only added after the # in the page address so you can share the result – browsers don't send that part of the address to the server.
Does a high CVSS score mean high risk for my organisation?
Not necessarily. The FIRST user guide says CVSS measures the severity of a vulnerability and shouldn't be used on its own to assess risk. Risk also depends on whether you run the affected system, whether it's exposed to the internet and whether the flaw is being exploited – which is what the CISA Known Exploited Vulnerabilities catalog tracks.
When should Scope be set to Changed?
When a flaw in one component lets an attacker affect resources governed by a different security authority. The FIRST guide gives the examples of escaping from a virtual machine to the host operating system, and cross-site scripting that affects the victim's browser. SQL injection usually isn't a Scope change when the web application and the database share credentials.
Why is my score different from the NVD's or the vendor's?
A score is only as good as the metrics chosen, and vendors and the NVD sometimes assess them differently. Compare the vectors metric by metric – if the vectors match, the base score matches too. The guide says base metrics should assume the attacker knows the target system well, and that libraries should be scored for the reasonable worst-case implementation.
What are environmental metrics for, and why can the environmental score come out higher than the base score?
Environmental metrics tailor the score to a specific organisation. The CR, IR and AR requirements say how serious a loss of confidentiality, integrity or availability would be for you (High weights the impact 1.5 times, Low halves it). The modified metrics (MAV, MPR and so on) describe what's different in your environment from the base assessment, and Not Defined keeps the base value. The 3.1 specification uses a slightly different impact formula for a changed scope in the environmental score than in the base score, so the environmental score can come out 0.1 higher even with no other changes.
Does the calculator support CVSS 4.0?
Not yet. Version 4.0 uses different metrics and a different calculation, so the tool rejects 4.0 vectors. It loads 3.0 vectors and scores them with the 3.1 formulas – according to the FIRST guide, the result can occasionally differ by 0.1 because 3.1 rounds more precisely.
Sources
Updated