What is the CVSS Score (Common Vulnerability Scoring System)

The Common Vulnerability Scoring System (CVSS) is a framework that is used to rate the severity of vulnerabilities in a software.

The greatest advantage of CVSS is that it's completely neutral in terms of vendors and applications. What this means is that you can use this same framework to score vulnerabilities across vast software products, regardless of the type or vendor.

The Forum of Incident Response and Security Teams (FIRST), a non-profit US organization consisting of 500 members, maintains this framework.

Which roles use the CVSS method?

By default, the security team is the one that normally relies on CVSS to score common vulnerabilities. But generally, the following roles within an organization can also utilize this method:

• Information security teams
• Security vendors
• Software and application vendors
• IT managers

Usage is not just limited to the above roles. Any person within the organization with the responsibility of ensuring that software products function properly can use this method to score vulnerabilities.

In terms of organizations, any organization that uses some form of software can use this method. This includes both private and government organizations. For example, CVSS has been incorporated into the Payment Card Industry Data Security Standard (PCI DSS) since 2007. The United States' Cybersecurity and Infrastructure Security Agency and the Department of Homeland Security also use the CVSS method.

How to calculate CVSS scores

CVSS scores are calculated using a formula that takes into account the three main groups of metrics:

• Base Metrics: These are the metrics that represent the intrinsic characteristics of the vulnerability. They assess the fundamental properties of a vulnerability itself that don't change with time or across different environments. Some of the qualities of a vulnerability that fall within this group include how the vulnerability can be exploited, the level of attacker skill required, and the impact of the vulnerability on the CIA triad. 
• Temporal metrics: The temporal group of metrics represent the qualities of a vulnerability that may change over time. 
• Environmental metrics: This group represents the qualities of a vulnerability that are unique to the user’s environment. 

The base metrics are the core metrics which produce the initial score. This score can then be modified upon scoring metrics in the temporal and environmental groups. Once the modification is done, you get the overall CVSS score. 

The actual calculation depends on the CVSS version that you are using. But the fundamental system remains the same. 

The first step is to assign values to the base metrics. Next, a base equation is used to compute a score. The score range is between 0.00 to 10.0. Zero represents the least severity while 10 represents the highest severity.

To simplify the scoring, FIRST maps the scores according to the following ratings:

The base score is the mandatory one while both the temporal and the environmental scores are optional.

The vendor or analyst provides the base score and the temporal score. The environmental score is calculated by the end user.

Since the other scores are optional, it means that the base score is the only requirement when categorizing a specific vulnerability. To do this, there are three base score components that have to be completed. These are as follows:

• The Exploitability sub-score
• The Impact sub-score
• The scope sub-score

From these three components, the overall base score is then calculated. The formula that is used for this calculation weighs each subscore.

Now with the base score, you can calculate the temporal score and the environmental score.

The temporal score is the easy one to calculate: Simply multiply the Base score by the temporal metrics (which are normally three).

To calculate the environmental score, you need to use the environmental metrics (normally 5).

Luckily, the Forum of Incident Response and Security Teams has created a CVSS calculator that simplifies the calculation. All you need to do is feed in the metrics and find the scores. The most recent CVSS version is CVSS v4.0, which is now under public view stage. Besides the FIRST CVSS calculator, NIST and Cisco also provide free calculators.

If you are not familiar with NIST, please spare a few minutes and acquaint yourself with the NIST framework for cybersecurity.

To make effective use of CVSS, FIRST encourages organizations to use CVSS as one of the inputs to their overall vulnerability management process. In this case, CVSS will act as one of the factors in your vulnerability management. This approach helps to bolster vulnerability management. Some of the factors you can use alongside CVSS include:

• Number of customers on a software line
• Financial losses as a result of a breach
• Threats to life or property
• Public sentiment on vulnerabilities that have been highly publicized

The organization maintaining the software is the one that is normally responsible for producing the base scores. If a third party is responsible for the software, then the third party will do the base scoring on behalf of the organization. Most organizations prefer to publish the base metrics only since they do not change over time and are common across the board.

Benefits of CVSS

CVSS offers distinct advantages that streamline vulnerability assessment. These are the key benefits:

1. Standardized scoring methodology

CVSS offers a uniform way to assess the severity of vulnerabilities across different vendors, software, and platforms.

This standardization allows organizations to compare, regardless of the specific technology stack. The outcome is less confusion and subjectivity in vulnerability assessment.

2. Transparent framework

The open nature of the CVSS framework means that its calculation method and metrics are well-documented and publicly available. 

This level of transparency enables organizations to understand how a CVSS score is determined for a given vulnerability. It also allows for independent validation and assessment of the scoring methodology.

Ultimately, this fosters trust in the scoring process and encourages collaboration within the security community.

3. Prioritization

CVSS scores help organizations prioritize vulnerabilities based on their severity. Higher scores indicate more critical vulnerabilities. This is important because it helps security teams to focus their resources on mitigating the most significant risks.

Prioritization is essential for effective vulnerability management, as organizations often face a large number of vulnerabilities. It would be impossible to approach them all with the same level of priority. CVSS scores provide a clear ranking system to address the most urgent issues promptly.

4. Consistency

CVSS ensures consistent and repeatable assessments of vulnerabilities. It follows a well-defined methodology. A refined methodology contributes to a reduction in the potential for errors and variations in scoring.

Consistency in vulnerability assessments is also crucial as it aids in making informed decisions regarding patch management, mitigation, and resource allocation. CVSS offers a reliable and predictable approach.

5. Efficient resource allocation

CVSS scores help organizations allocate security resources effectively. By focusing on vulnerabilities with higher scores, your teams can optimize their efforts to address the most critical threats first.

Efficient resource allocation is essential in situations where resources are limited. In such cases, CVSS assists in maximizing the impact of security investments by targeting critical vulnerabilities.

6. Communication

CVSS scores serve as a common language for communication about vulnerabilities between security teams, vendors, and stakeholders. They simplify discussions and reporting.

Effective communication is essential for conveying the severity of vulnerabilities to decision-makers and ensuring that the appropriate actions are taken to address them. CVSS scores facilitate this communication process.

7. Alignment with business goals

CVSS allows you to align vulnerability management efforts with your business goals as well as risk tolerance. It helps in making decisions that are in line with the organization's overall strategy.

Businesses can use CVSS scores to assess the potential impact of vulnerabilities on critical systems and data. This alignment ensures that security decisions are consistent with the organization's objectives.

For instance, imagine a software company that values user data security as a top priority. Using CVSS scores, they identify a vulnerability in their application with a high score, indicating a significant risk to data integrity. They promptly allocate resources to address this vulnerability, aligning their vulnerability management efforts with their business goal of ensuring customer trust and data protection.

CVSS vs. CVE

The main difference between CVSS and CVE (Common Vulnerabilities and Exposures) lies in their roles within cybersecurity. CVSS quantifies vulnerability severity using a standardized scale, facilitating risk assessment. On the other hand, CVE provides unique identifiers for vulnerabilities, which simplifies tracking and communication within the cybersecurity community.

Here's a breakdown of the differences in detail:

Purpose

• CVSS: Designed to assess and quantify the severity of vulnerabilities.
• CVE: Intended to provide a unique identifier for each known vulnerability.

Function

• CVSS: Focuses on scoring vulnerabilities based on their characteristics and potential impact.
• CVE: Focuses on creating a standardized naming system to easily track and reference vulnerabilities.

Measurement

• CVSS: Employs a numerical scoring system from 0 to 10 to represent vulnerability severity.
• CVE: Uses alphanumeric identifiers (e.g., CVE-2023-12345) to uniquely label vulnerabilities.

Usage

• CVSS: Used by organizations to prioritize vulnerabilities and allocate resources for remediation.
• CVE: Used for referencing and sharing information about vulnerabilities across the cybersecurity community.

Information provided

• CVSS: Provides a severity score based on factors like attack vectors, impact, and exploitability.
• CVE: Provides a unique identifier to reference and search for information related to a specific vulnerability.

In short, CVE serves as a catalog for known threats. The threats are categorized into two. The first category is vulnerabilities. The second category is exposures. The aim of CVE is to enable standardization of all known vulnerabilities and exposures. The overarching goal of CVE revolves around establishing a universal standard for organizing and identifying these known vulnerabilities and exposures. Each individual threat is assigned a distinct identifier.

To simplify further, consider CVSS as a numerical rating assigned to assess the gravity of a vulnerability. Conversely, CVE functions as a comprehensive inventory of all officially acknowledged vulnerabilities.

But one thing to note is that CVSS and CVE have a symbiotic relationship, and this is perhaps why they are often confused to mean the same thing.

How does this interdependency come about? CVSS relies on CVE to identify the vulnerability, whereas CVE relies on CVSS to gauge the seriousness of said vulnerability.