|
|
Table of Contents | [top] |
|
|
Overview | [top] |
The Common Vulnerability Scoring System (CVSS)[1], the emerging standard in vulnerability scoring.
This rating system is designed to provide open and universally standard severity ratings of software vulnerabilities.
A metric is a constituent component or characteristic of a vulnerability that can be quantitatively or qualitatively measured.
These atomic values are clustered together in three separate areas: a base group (Base Metrics), a temporal group (Temporal Metrics), and an environmental group (Environmental Metrics).
The base group contains all of the qualities that are intrinsic and fundamental to any given vulnerability that do not change over time or in different environments.
The temporal group contains the characteristics of a vulnerability that are time-dependent and change as the vulnerability ages.
Finally, the environmental group contains the characteristics of vulnerabilities that are tied to implementation and environment.
The final adjusted score represents the threat a vulnerability presents at a particular point in time for a specific environmental condition.
|
[1] FIRST: Common Vulnerability Scoring System (CVSS-SIG), http://www.first.org/cvss/
[2] NIST: National Vulnerability Database CVSS Scoring, http://nvd.nist.gov/cvss.cfm
|
|
|
CVSS Calculator | [top] |
CVSS V1.0 Calculator for Server Version (Ver1.0)
http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/en/index.01.html#ssCVSSv1
|
CVSS V1.0 Calculator for PC Version (Ver1.0)
- CVSS V1.0 Calculator
Chinese
| Dutch
| English
| German
| Japanese
| Korean
| Portuguese
| Spanish
CVSS V1.0 Calculator includes ...
Acknowledgments
JVNRSS Feasibility Study Team thanks the following for working with us:
- Spanish: Language translation is supported by paco.
- Chinese: Language translation is supported by CNCERT/CC.
.
- Korean: Language translation is supported by KrCERT/CC.
- Portuguese: Language translation is supported by Antonio Marques.
- Dutch: Language translation is supported by Arjen de Landgraaf. [ E-Secure-IT ]
parameter.xml
- Demonstration Example
Chinese
| Dutch
| English
| German
| Japanese
| Korean
| Portuguese
| Spanish
Parameters of Demonstration Example ScoreCalc.swf are "ScoreCalcPC.swf ?name=CVE-9999-9999-Example &vector=(AV:R/AC:L/Au:NR/C:C/I:C/A:C/B:N) &temp=(E:P/RL:O/RC:Co) &env=(C:M/T:H) &fn=parameter.{$LANG}.xml &g=999"
Parameter | Description |
?name=CVE-9999-9999-Example | Vulnerability Name |
&vector=(AV:R/AC:L/Au:NR/C:C/I:C/A:C/B:N) | CVSS Base Metrics |
&temp=(E:P/RL:O/RC:Co) | CVSS Temporal Metrics |
&env=(C:M/T:H) | CVSS Environmental Metrics |
&fn=parameter.{$LANG}.xml | Parameter description file of CVSS V1.0 Calculator |
&g=999 | CVSS Calculator Themes (change the look)
0: Circle chart
1: Bar chart
2: Temperature meter
3: Bar chart (variant)
4: Judge
5: Gas meter
6: Slot meter
7: Stamp
8: Balloon meter
9: Patting
10: Bowling
11: KARATE
Other: Random selection mode
|
|
|
|
Definition of CVSS Calculator parameters | [top] |
Note: Currently, abbreviation of parameters is localized definition.
The next version of CVSS calculator will support a standard of abbreviation of parameters.
[1][2]
|
The letters within brackets represent possible values of CVSS Base, Temporal and Environmental Metrics.
Exactly one option must be chosen for each set of brackets.
Letters not within brackets are mandatory and must be included in order to create valid CVSS Base, Temporal and Score Environmental Metrics.
Each letter or pair of letters is an abbreviation for a metric or metric value within CVSS.
CVSS Base Metrics
CVSS Base Metrics take the following form:
vector=(AV:[R,L]/AC:[H,L]/Au:[R,NR]/C:[N,P,C]/I:[N,P,C]/A:[N,P,C]/B:[N,C,I,A])
Metric: AV = AccessVector (Related exploit range)
Possible Values: R = Remote, L = Local
Metric: AC = AccessComplexity (Required attack complexity)
Possible Values: H = High, L = Low
Metric: Au = Authentication (Level of authentication needed to exploit)
Possible Values: R = Required, NR = Not Required
Metric: C = ConfImpact (Confidentiality impact)
Possible Values: N = None, P = Partial, C = Complete
Metric: I = IntegImpact (Integrity impact)
Possible Values: N = None, P = Partial, C = Complete
Metric: A = AvailImpact (Availability impact)
Possible Values: N = None, P = Partial, C = Complete
Metric: B = ImpactBias (Impact value weighting)
Possible Values: N = Normal, C = Confidentiality, I = Integrity, A = Availability
CVSS Temporal Metrics
CVSS Temporal Metrics take the following form:
temp=(E:[U,P,F,H]/RL:[O,T,W,U]/RC:[U,Co,C])
Metric: E = Exploitability (Availability of exploit)
Possible Values: U = Unproven, P = Proof-of-concept, F = Functional, H = High
Metric: RL = RemediationLevel (Type of fix available)
Possible Values: O = Official-fix, T = Temporary-fix, W = Workaround, U = Unavailable
Metric: RC = ReportConfidence (Level of verification that the vulnerability exists)
Possible Values: U = Unconfirmed, Co = Uncorroborated, C = Confirmed
CVSS Environmental Metrics
CVSS Environmental Metrics take the following form:
env=(C:[N,L,M,H]/T:[N,L,M,H])
Metric: C = CollateralDamagePotential (Organization specific potential for loss)
Possible Values: N = None. L = Low (light loss), M = Medium (significant loss), H = High (catastrophic loss)
Metric: T = TargetDistribution (Percentage of vulnerable systems)
Possible Values: N = None (0%), L = Low (1-15%), M = Medium (16-49%), H = High (50-100%)
|
[1] NIST: National Vulnerability Database CVSS Scoring, http://nvd.nist.gov/cvss.cfm?vectorinfo
[2] NIST: CVSS v2 Vector Definitions, http://nvd.nist.gov/cvss.cfm?vectorinfov2
|
|
|
Revisions | [top] |
- Published.: 2006-09-17T14:33+00:00
- parameter.xml of Spanish version released.: 2006-10-05T13:49+00:00
- Link added - NIST: CVSS v2 Vector Definitions.: 2006-10-08T02:09+00:00
- parameter.xml of Chinese version released.: 2006-10-10T06:02+00:00
- parameter.xml of Korean version released.: 2006-10-11T09:29+00:00
- Figure added - parameter.xml.: 2006-10-13T07:34+00:00
- parameter.xml of Portuguese version released.: 2007-02-15T12:26+00:00
- New Theme (10. Bowling) added.: 2007-03-10T03:31+00:00
- New Theme (11. KARATE) added.: 2007-03-24T16:09+00:00
- parameter.xml of German version released.: 2007-04-20T17:30+00:00
- parameter.xml of Dutch version released.: 2007-04-30T15:14+00:00
|
|
|
|
|