|
|
Table of Contents | [top] |
|
|
Overview | [top] |
The Common Vulnerability Scoring System (CVSS)[1], the emerging standard in vulnerability scoring.
This rating system is designed to provide open and universally standard severity ratings of software vulnerabilities.
A metric is a constituent component or characteristic of a vulnerability that can be quantitatively or qualitatively measured.
These atomic values are clustered together in three separate areas: a base group (Base Metrics), a temporal group (Temporal Metrics), and an environmental group (Environmental Metrics).
The base group contains all of the qualities that are intrinsic and fundamental to any given vulnerability that do not change over time or in different environments.
The temporal group contains the characteristics of a vulnerability that are time-dependent and change as the vulnerability ages.
Finally, the environmental group contains the characteristics of vulnerabilities that are tied to implementation and environment.
The final adjusted score represents the threat a vulnerability presents at a particular point in time for a specific environmental condition.
|
[1] FIRST: Common Vulnerability Scoring System (CVSS-SIG), http://www.first.org/cvss/
[2] NIST: National Vulnerability Database CVSS Scoring, http://nvd.nist.gov/cvss.cfm
|
|
|
CVSS Calculator | [top] |
CVSS V2.0 Calculator for PC
|
Arabic
| Chinese
| Dutch
| English
| French
| German
| Japanese
| Korean
| Portuguese
| Spanish
|
Parameters of Demonstration Example ScoreCalc2PC.swf are "ScoreCalc2PC.swf ?name=CVE-9999-9999-Example &vector=(AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:TF/RC:UC/CDP:L/TD:H/CR:M/IR:M/AR:H) &fn=parameter2.{$LANG}.xml &g=999"
Parameter | Description |
?name=CVE-9999-9999-Example | Vulnerability Name |
&vector=(AV:N/AC:L/Au:N/C:C/I:C/A:C/
E:POC/RL:TF/RC:UC/
CDP:L/TD:H/CR:M/IR:M/AR:H) | Base, Temporal, Environmental Vectors
[See CVSS V2.0 Vector Definitions] |
&fn=parameter2.{$LANG}.xml | Parameter description file of CVSS V2.0 Calculator |
&g=999 | CVSS Calculator Themes (change the look)
d: Debug Version
0: Circle chart
1: Bar chart
Other: Random selection mode
|
|
CVSS V2.0 Vector Definitions
|
Each metric in the vector consists of the abbreviated metric name, followed by a ":" (colon), then the abbreviated metric value. The vector lists these metrics in a predetermined order, using the "/" (slash) character to separate the metrics. If a temporal or environmental metric is not to be used, it is given a value of "ND" (not defined). The base, temporal, and environmental vectors are shown below in Table.
Metric Type | Description |
Base | AV:[L,A,N]/AC:[H,M,L]/Au:[M,S,N] /C:[N,P,C]/I:[N,P,C]/A:[N,P,C] |
Temporal | E:[U,POC,F,H,ND]/RL:[OF,TF,W,U,ND]/RC:[UC,UR,C,ND] |
Environmental | CDP:[N,L,LM,MH,H,ND]/TD:[N,L,M,H,ND] /CR:[L,M,H,ND]/IR:[L,M,H,ND]/AR:[L,M,H,ND] |
|
[1] FIRST CVSS-SIG: A Complete Guide to the Common Vulnerability Scoring System Version 2.0, http://www.first.org/cvss/cvss-guide.html#i2.4
[2] NIST NVD: CVSS v2 Vector Definitions, http://nvd.nist.gov/cvss.cfm?vectorinfov2
|
|
|
Acknowledgments | [top] |
JVNRSS Feasibility Study Team thanks the following for working with us:
- German: Language translation is supported by Fahim Nawabi and Akira Yamada.
|
|
|
Revisions | [top] |
- CVSS Calculator Published.: 2006-09-17T14:33+00:00
- CVSS V2.0 Calculator for Server (Development Version) published.: 2007-06-05T21:31+00:00
- parameter2.xml of German version released.: 2007-07-27T16:02+00:00
- New Theme (2. Circle chart, 3. Bar chart) added in CVSS V2.0 Calculator for Server.: 2007-07-27T16:02+00:00
- CVSS V2.0 Calculator for PC released.: 2007-08-21T07:10+00:00
- parameter2.xml of French version released.: 2007-11-14T01:34+00:00
- parameter2.xml of Spanish version released.: 2007-11-14T01:34+00:00
- parameter2.xml of Arabic version released.: 2008-02-01T00:11+00:00
|
|
|
|
|