Common Vulnerability Scoring System
Common Vulnerability Scoring System (CVSS) is an industry standard for assessing the severity of computer system security vulnerabilities. It attempts to establish a measure of how much concern a vulnerability warrants, compared to other vulnerabilites, so efforts can be prioritized. The score is based on a series of measurements (called metrics) based on expert assessment.
Metrics
The CVSS assessment measures (against a metric) three areas of concern:
- Base Metrics for qualities intrinsic to a vulnerability.
- Temporal Metrics for characteristics that evolve over the lifetime of vulnerability.
- Environmental Metrics for characteristics of a vulnerability that depend on a particular implementation or environment.
Base Metrics
- Is the vulnerability exploitable remotely (as opposed to only locally).
- How complex must an attack be to exploit the vulnerability?
- Is authentication required to attack?
- Does the vulnerabilty expose confidential data?
- Can attacking the vulnerability damage the integrity of the system?
- Does it impact availability of the system?
Tempral Metric
- How complex (or how long will it take) to attack the vulnerability.
- How hard (or how long) will it take to remediate the vulnerability.
- How certain is the vulnerability's existence.
Environmental Metric
- Potential to cause collateral damage
- How many systems (or how much of a system) does the vulnerability impact.