# WTF is a CVSS score?

> Sarge says: CVSS tells you how hard the round hits, not whether it is headed your way.

- Term: CVSS
- Also called: CVSS score; CVSS rating; CVSS-B; severity score; severity rating; Common Vulnerability Scoring System
- Section: The basics
- Web page: https://codemarine.ai/learn/cvss-severity/

## Short version

CVSS is a 0 to 10 score for how severe a security flaw is, not how likely it is to hit you.

## CVSS severity scale

| Rating | CVSS score |
| --- | --- |
| None | 0.0 |
| Low | 0.1 to 3.9 |
| Medium | 4.0 to 6.9 |
| High | 7.0 to 8.9 |
| Critical | 9.0 to 10.0 |

## The briefing

- **Who owns it:** The Common Vulnerability Scoring System is owned and managed by FIRST, a US-based non-profit.
- **Version:** Currently 4.0.
- **Base score:** The number you usually see, written CVSS-B in version 4.0. It rates the flaw itself: can it be reached over the network, does the attacker need a login, what can they do once through.
- **Blind spots:** The base score knows nothing about your setup or whether anyone is using the bug right now.
- **The rest is your job:** CVSS has Threat and Environmental metrics to adjust for those things, but publishers typically give only the base score.
- **FIRST says it plainly:** Base scores measure severity and should not be used alone to assess risk.
- **EPSS:** Also from FIRST: an estimated probability that a CVE will be exploited in the wild in the next 30 days. A forecast, not a sighting.

## In the Threat Brief this looks like

> CVE-YYYY-NNNN in ExampleApp. CVSS 9.8 (Critical).

Critical is how bad the flaw is, not how likely it is to hit you. A critical on a system you do not run is noise.

Example only. The product, versions and names are made up.

## What to do

- Treat the score as one input. CVSS tells you how bad.
- Check KEV to see if it is being used.
- Let your own exposure decide the rest. A high on your internet-facing login page, listed on KEV, is your morning.

## Official sources

- [FIRST: Common Vulnerability Scoring System](https://www.first.org/cvss/)
- [FIRST: CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document)
- [FIRST: CVSS v4.0 User Guide](https://www.first.org/cvss/v4.0/user-guide)
- [FIRST: Exploit Prediction Scoring System (EPSS)](https://www.first.org/epss/)

## Related

- [CVE](https://codemarine.ai/learn/wtf-is-a-cve.md)
- [CISA KEV](https://codemarine.ai/learn/cisa-kev.md)
- [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md)