Table of Contents[top]

   Overview[top]
The Common Vulnerability Scoring System (CVSS)[1], the emerging standard in vulnerability scoring. This rating system is designed to provide open and universally standard severity ratings of software vulnerabilities. A metric is a constituent component or characteristic of a vulnerability that can be quantitatively or qualitatively measured. These atomic values are clustered together in three separate areas: a base group (Base Metrics), a temporal group (Temporal Metrics), and an environmental group (Environmental Metrics). The base group contains all of the qualities that are intrinsic and fundamental to any given vulnerability that do not change over time or in different environments. The temporal group contains the characteristics of a vulnerability that are time-dependent and change as the vulnerability ages. Finally, the environmental group contains the characteristics of vulnerabilities that are tied to implementation and environment. The final adjusted score represents the threat a vulnerability presents at a particular point in time for a specific environmental condition.
[1] FIRST: Common Vulnerability Scoring System (CVSS-SIG), http://www.first.org/cvss/
[2] NIST: National Vulnerability Database CVSS Scoring, http://nvd.nist.gov/cvss.cfm

   CVSS Calculator[top]
CVSS V1.0 Calculator for Server Version (Ver1.0)
http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/en/index.01.html#ssCVSSv1
CVSS V1.0 Calculator for PC Version (Ver1.0)
  1. CVSS V1.0 Calculator
    Chinese | Dutch | English | German | Japanese | Korean | Portuguese | Spanish

    CVSS V1.0 Calculator includes ...
    File NameDescription
    CVSSv1.{$LANG}.htmlLoad ScoreCalc.{$LANG}.js
    ScoreCalc.{$LANG}.jsLoad ScoreCalcPC.swf
    ScoreCalcPC.swf + stub.swfCVSS V1.0 Calculator for PC Version Body
    ScoreCalcPC.swf is enabled on your PC.
    [ General License in Feasibility Study Site for JVNRSS and RSS Extension]
    parameter.{$LANG}.xmlParameter description file for CVSS V1.0 Calculator (ScoreCalcPC.swf) by each language and UTF-8 encoding.
    [ Ex. Chinese | Dutch | English | German | Japanese | Korean | Portuguese | Spanish ]

    Acknowledgments
    JVNRSS Feasibility Study Team thanks the following for working with us:
    • Spanish: Language translation is supported by paco.
    • Chinese: Language translation is supported by CNCERT/CC.
      CNCERT/CC.
    • Korean: Language translation is supported by KrCERT/CC.
      KrCERT/CC
    • Portuguese: Language translation is supported by Antonio Marques.
      Faculdade de Engenharia da Universidade do Porto
    • Dutch: Language translation is supported by Arjen de Landgraaf. [ E-Secure-IT ]

    parameter.xml
    Parameter description file for CVSS V1.0 Calculator.

  2. Demonstration Example
    Chinese | Dutch | English | German | Japanese | Korean | Portuguese | Spanish

    Parameters of Demonstration Example ScoreCalc.swf are "ScoreCalcPC.swf ?name=CVE-9999-9999-Example &vector=(AV:R/AC:L/Au:NR/C:C/I:C/A:C/B:N) &temp=(E:P/RL:O/RC:Co) &env=(C:M/T:H) &fn=parameter.{$LANG}.xml &g=999"
    ParameterDescription
    ?name=CVE-9999-9999-ExampleVulnerability Name
    &vector=(AV:R/AC:L/Au:NR/C:C/I:C/A:C/B:N)CVSS Base Metrics
    &temp=(E:P/RL:O/RC:Co)CVSS Temporal Metrics
    &env=(C:M/T:H)CVSS Environmental Metrics
    &fn=parameter.{$LANG}.xmlParameter description file of CVSS V1.0 Calculator
    &g=999CVSS Calculator Themes (change the look)
    0: Circle chart
    1: Bar chart
    2: Temperature meter
    3: Bar chart (variant)
    4: Judge
    5: Gas meter
    6: Slot meter
    7: Stamp
    8: Balloon meter
    9: Patting
    10: Bowling
    11: KARATE
    Other: Random selection mode

   Definition of CVSS Calculator parameters[top]
Note: Currently, abbreviation of parameters is localized definition. The next version of CVSS calculator will support a standard of abbreviation of parameters. [1][2]
The letters within brackets represent possible values of CVSS Base, Temporal and Environmental Metrics. Exactly one option must be chosen for each set of brackets. Letters not within brackets are mandatory and must be included in order to create valid CVSS Base, Temporal and Score Environmental Metrics. Each letter or pair of letters is an abbreviation for a metric or metric value within CVSS.

CVSS Base Metrics

CVSS Base Metrics take the following form:
vector=(AV:[R,L]/AC:[H,L]/Au:[R,NR]/C:[N,P,C]/I:[N,P,C]/A:[N,P,C]/B:[N,C,I,A])

Metric: AV = AccessVector (Related exploit range)
Possible Values: R = Remote, L = Local

Metric: AC = AccessComplexity (Required attack complexity)
Possible Values: H = High, L = Low

Metric: Au = Authentication (Level of authentication needed to exploit)
Possible Values: R = Required, NR = Not Required

Metric: C = ConfImpact (Confidentiality impact)
Possible Values: N = None, P = Partial, C = Complete

Metric: I = IntegImpact (Integrity impact)
Possible Values: N = None, P = Partial, C = Complete

Metric: A = AvailImpact (Availability impact)
Possible Values: N = None, P = Partial, C = Complete

Metric: B = ImpactBias (Impact value weighting)
Possible Values: N = Normal, C = Confidentiality, I = Integrity, A = Availability

CVSS Temporal Metrics

CVSS Temporal Metrics take the following form:
temp=(E:[U,P,F,H]/RL:[O,T,W,U]/RC:[U,Co,C])

Metric: E = Exploitability (Availability of exploit)
Possible Values: U = Unproven, P = Proof-of-concept, F = Functional, H = High

Metric: RL = RemediationLevel (Type of fix available)
Possible Values: O = Official-fix, T = Temporary-fix, W = Workaround, U = Unavailable

Metric: RC = ReportConfidence (Level of verification that the vulnerability exists)
Possible Values: U = Unconfirmed, Co = Uncorroborated, C = Confirmed

CVSS Environmental Metrics

CVSS Environmental Metrics take the following form:
env=(C:[N,L,M,H]/T:[N,L,M,H])

Metric: C = CollateralDamagePotential (Organization specific potential for loss)
Possible Values: N = None. L = Low (light loss), M = Medium (significant loss), H = High (catastrophic loss)

Metric: T = TargetDistribution (Percentage of vulnerable systems)
Possible Values: N = None (0%), L = Low (1-15%), M = Medium (16-49%), H = High (50-100%)

[1] NIST: National Vulnerability Database CVSS Scoring, http://nvd.nist.gov/cvss.cfm?vectorinfo
[2] NIST: CVSS v2 Vector Definitions, http://nvd.nist.gov/cvss.cfm?vectorinfov2

   Revisions[top]
  • Published.: 2006-09-17T14:33+00:00
  • parameter.xml of Spanish version released.: 2006-10-05T13:49+00:00
  • Link added - NIST: CVSS v2 Vector Definitions.: 2006-10-08T02:09+00:00
  • parameter.xml of Chinese version released.: 2006-10-10T06:02+00:00
  • parameter.xml of Korean version released.: 2006-10-11T09:29+00:00
  • Figure added - parameter.xml.: 2006-10-13T07:34+00:00
  • parameter.xml of Portuguese version released.: 2007-02-15T12:26+00:00
  • New Theme (10. Bowling) added.: 2007-03-10T03:31+00:00
  • New Theme (11. KARATE) added.: 2007-03-24T16:09+00:00
  • parameter.xml of German version released.: 2007-04-20T17:30+00:00
  • parameter.xml of Dutch version released.: 2007-04-30T15:14+00:00


	

Last updated: 2007-05-07T22:18+00:00
Valid HTML 4.01! Valid CSS!