CVSS Calculator

CVSS v3.1 turns eight judgements about a vulnerability into one number between 0.0 and 10.0. The judgements are the interesting part; the number is a summary of them. This page works in both directions — pick the metrics and watch the vector build, or paste a vector out of an advisory and see what it decodes to and which term is driving the result.

The score is two sub-scores, not one calculation

Impact comes from the Confidentiality, Integrity and Availability metrics: how bad it is when the flaw is used. Exploitability comes from Attack Vector, Attack Complexity, Privileges Required and User Interaction: how much has to go right for an attacker to use it. Both are shown here, because a 7.5 built from total impact behind a hard precondition and a 7.5 built from partial impact reachable by anyone are different problems with the same label.

Scope changes two things at once

Scope asks whether the flaw reaches past the component it lives in — a hypervisor escape, a sandbox break, a library flaw that compromises the host. Setting it to Changed switches Impact to a different equation and raises the weight of Privileges Required, because privilege spent to escape a boundary is worth more than privilege spent inside one. It is the part of the specification most commonly implemented wrongly, and the part most likely to make two calculators disagree.

What a base score does not tell you

Nothing about your environment. A base score describes the vulnerability in the abstract: not whether the affected component is internet-facing, not whether a compensating control exists, and not whether anyone is exploiting it. Those belong to the Environmental and Temporal metric groups, which this page reads from a pasted vector and reports but does not score. For exploitation status, see Quietlytic’s vulnerability intelligence.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is 9.8 Critical — unauthenticated, over the network, total loss of all three. Change nothing but Scope to S:C and it reaches 10.0. Change the impacts to C:L/I:L/A:N and add UI:R, the shape of a reflected cross-site scripting flaw, and the same otherwise-identical vector scores 6.1 Medium.