The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities.
CVSS provides a way to capture the characteristics of a vulnerability and produce a numerical score reflecting its severity. The numerical score is then translated into a user-friendly severity rating (i.e. low, medium, high, and critical) to help organisations properly assess and prioritise vulnerabilities.
CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based not-for-profit organisation, whose mission is to help computer security incident response teams across the world.
At Defense.com, we use CVSS scores to provide feedback in our Penetration Test and Vulnerability Scan Reports.
Below is a breakdown of the level of risk each numerical CVSS score relates to.
RISK LEVEL | DESCRIPTION |
CRITICAL | A critical risk indicates a serious and immediate risk to systems and data being compromised. |
HIGH | High risk indicates that a serious weakness or exposure exists. |
MEDIUM | Medium risk indicates that a significant issue needs to be addressed. |
LOW | Low risk indicates minor issues that most of the time are harmless and can be used when profiling an organisation. |
And that's it! You now have a basic understanding of CVSS scoring. 🎉