CVSS

Informational

Common Vulnerability Scoring System

Definition

CVSS (Common Vulnerability Scoring System) is an open standard for assessing the severity of security vulnerabilities. It assigns a score from 0.0 to 10.0 based on metrics such as the attack vector, complexity, required privileges, user interaction and the impact on confidentiality, integrity and availability. The current version is CVSS v3.1.

Impact

Objective, standardized assessment of vulnerability severityDetermining patching priorityCalculating rewards in bug bounty programsClear risk communication between technical and business teams

Examples

CVSS v3.1 severity ranges

CVSS scores are classified as: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0). For example, an SSRF that leads to RCE without authentication usually scores a CVSS of 9.8 (Critical), while an Open Redirect on its own usually gets a 3.4 (Low).

External references

FIRST - CVSS v3.1 Calculator

Related terms

CVE

Common Vulnerabilities and Exposures

CWE

Common Weakness Enumeration

OWASP Top 10

Responsible Disclosure

Bug Bounty

Practice CVSS with real labs

Apply what you've learned in safe environments based on real bug bounty reports.

See practice labs

hunters training: 712
labs from real reports: 55
completions: 1,206
in bounties practiced: $213,970

46 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime