CVSS in plain English
In an emergency room, gut feeling doesn’t decide who gets treated first. A fixed triage scheme classifies every case according to clear criteria. CVSS does something similar for security vulnerabilities. The abbreviation stands for “Common Vulnerability Scoring System” – a standardized system for rating vulnerabilities.
The standard is published by FIRST (Forum of Incident Response and Security Teams), an international association of security and incident response teams. Version 4.0 has been available since 2023, but many databases and reports still use the previous version, 3.1. The numerical score translates into a qualitative rating:
- 0.0: None
- 0.1 to 3.9: Low
- 4.0 to 6.9: Medium
- 7.0 to 8.9: High
- 9.0 to 10.0: Critical
How CVSS scoring works
The rating answers a set of fixed questions. Each question has predefined answer levels, and a formula calculates the score from them. The most important criteria of the base score are:
- Attack vector: Where can an attack be launched from? Over the network, for example from the internet? Only from an adjacent network, such as the same Wi-Fi? Or only locally on the device – in the extreme case, only with physical access?
- Complexity: Does the attack work at any time, or does the attacker need special conditions?
- Privileges required: Does the attacker already need a user account – or even administrator rights?
- User interaction: Does someone have to click a link or open a file?
- Impact: Can an attacker read data (confidentiality), modify data (integrity), or take a system down (availability)?
The score is usually accompanied by what is known as the vector. This is a shorthand notation of all the answers, such as “AV:N” for “attack vector: network.” It makes every rating traceable and verifiable.
CVSS also includes additional metrics. They take into account, for example, whether attack tools are already in circulation and how important the affected system is in a specific environment. Public databases, however, usually list only the base score.
A practical example
Here’s a typical scenario: A tax advisory firm commissions its first penetration test – an authorized, simulated attack. Two findings stand out in the report. The first concerns outdated software on an internal test server: CVSS 9.8, critical. The second concerns the document exchange on the firm’s website. Any logged-in user who changes a number in the address bar can retrieve other clients’ documents: CVSS 6.5, medium.
At first glance, the test server seems more urgent. In context, things look different: the server is only reachable internally and contains no real data. The website vulnerability, on the other hand, exposes confidential client data that is subject to professional secrecy. The report therefore recommends fixing it first. The firm also shuts down the test server promptly: it is no longer needed and could serve attackers as a stepping stone inside the internal network.
Why does this matter for businesses?
CVSS creates a common language. Vendors, scanners, and testing teams rate vulnerabilities according to the same rules. This makes it possible to compare findings from different sources and to allocate resources where they matter most. Many organizations also set deadlines by which vulnerabilities must be fixed, depending on their CVSS rating.
But CVSS measures the severity of a vulnerability, not your individual risk. Even its publisher emphasizes that the base score alone is no substitute for a risk assessment. Whether a vulnerability is critical for you depends on which data is affected, how easily the system can be reached, and which safeguards are already in place. Conversely, several medium findings can combine into a dangerous attack path.
What to look out for
- Ask for the vector: A score without a vector cannot be verified. Good reports state both.
- Check the version: Scores under CVSS 3.1 and 4.0 are not directly comparable. The report should state which version was used.
- Insist on context: Don’t just ask for the base score – ask what it means for your organization.
- Take medium findings seriously: Check whether several vulnerabilities can be chained into a single attack.
- Set deadlines: Define by when findings must be fixed, depending on their rating.
- Confirm the fix: Have closed vulnerabilities verified in a retest, a follow-up test.
How Rootsektor can help
In our pentest reports, we rate every finding using CVSS and also put it into the context of your organization. The executive summary translates the results for senior management, while the technical section gives your IT team the vector, evidence, and a concrete remediation recommendation. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person. Learn more about our approach under Penetration Testing.