Request sample reportGet a quote
Get a quote Request sample report

Free tool

CVSS v3.1 Calculator

Score a vulnerability with the CVSS v3.1 base metrics. Pick each metric, or paste a vector string, and see what every choice means in plain English.

Runs entirely in your browser. Nothing you enter is sent to us.

Attack Vector (AV)Where does the attacker need to be?
Attack Complexity (AC)Does the attack depend on conditions outside the attacker’s control?
Privileges Required (PR)What access does the attacker need before attacking?
User Interaction (UI)Does someone other than the attacker need to do something?
Scope (S)Can the attack affect components beyond the vulnerable one?
Confidentiality (C)How much data can the attacker read?
Integrity (I)How much data can the attacker change?
Availability (A)How much can the attacker disrupt the service?

Base score

0.0

Info

None

Impact
0.0
Exploitability
0.0

What your choices mean

    How to use the result

    Using a CVSS score well

    The base score describes how severe a vulnerability is in general: how easy it is to exploit and how much damage it could do. It doesn't know anything about your business.

    That's why we pair CVSS with business impact in every report. A medium-scored flaw in your payment flow can matter more than a high-scored one on an isolated test server. See our severity model for how we rate findings.

    Tips: score the vulnerability as it exists today, not the worst case you can imagine; use Scope: Changed only when the attack crosses a security boundary; and record the vector string with the score, so anyone can check how it was reached.

    Background

    What CVSS measures

    The Common Vulnerability Scoring System (CVSS) is an open standard, maintained by FIRST, for describing how severe a software vulnerability is. Version 3.1 scores a vulnerability from 0.0 to 10.0 using eight base metrics.

    Four metrics describe how hard the vulnerability is to exploit: Attack Vector, Attack Complexity, Privileges Required and User Interaction. Three describe what an attacker gains: the impact on Confidentiality, Integrity and Availability. The eighth, Scope, records whether the attack reaches beyond the vulnerable component, for example from a web application into a user's browser.

    From score to rating

    • None: 0.0
    • Low: 0.1 to 3.9
    • Medium: 4.0 to 6.9
    • High: 7.0 to 8.9
    • Critical: 9.0 to 10.0

    Reading a vector string

    A vector such as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N records every choice in one line. Anyone can paste it into a calculator, this one included, and get the same score. That's why a report should show the vector next to every score: it makes the rating checkable.

    What this calculator doesn't cover

    It calculates the base score only. CVSS v3.1 also defines Temporal metrics, such as whether exploit code exists, and Environmental metrics, such as how important the affected system is to you. Both adjust the base score for a specific situation. CVSS v4.0, published in 2023, uses a different set of metrics, so v3.1 and v4.0 scores can't be compared directly.

    FAQ

    CVSS Calculator questions

    Is a CVSS score the same as risk?

    No. CVSS describes the technical severity of a vulnerability. Risk also depends on how likely an attack is and what the affected system means to your business. A good report shows both.

    When should Scope be set to Changed?

    When exploiting the vulnerability affects something governed by a different security authority from the vulnerable component itself. Common examples are cross-site scripting, where a flaw in a web app runs code in the user's browser, and a sandbox or virtual machine escape.

    Why is my score different from the one in a public advisory?

    Advisories usually score the worst reasonable case for the product in general. Your deployment may differ: a feature may be switched off, or exploitation may need an account. Score what applies to you and keep the vector string, so the reasoning is visible.

    Should we use CVSS v3.1 or v4.0?

    Either can work, as long as you use one version consistently and say which. Many advisories, tools and compliance reports still use v3.1. Don't mix versions in one report, because the scores aren't comparable.

    Related

    Guide7 min read

    How to Read a Penetration Test Report

    How to read a penetration test report: what severity ratings mean, how to judge the evidence, which findings to fix first, and how the retest closes the loop.