Pick the eight base metrics or paste a vector string. Get the score, the severity band and the vector to put in a report.
The Common Vulnerability Scoring System, kept by FIRST, rates how severe a vulnerability is on a scale from 0.0 to 10.0. The base score is built from eight metrics that describe the flaw itself: how it is reached, how hard it is to use, and what it does to confidentiality, integrity and availability.
The specification maps the number to a rating: 0.0 is None, 0.1 to 3.9 is Low, 4.0 to 6.9 is Medium, 7.0 to 8.9 is High and 9.0 to 10.0 is Critical. This calculator follows the v3.1 specification, including its rule for rounding up to one decimal place, so a vector gives the same score here as it does in the National Vulnerability Database.
Attack vector is how far away the attacker can be: across the network, on the same segment, logged in locally, or touching the device. Attack complexity is whether the attack works every time or needs conditions outside the attacker's control. Privileges required and user interaction say whether an account is needed first and whether a person has to be tricked into doing something.
Scope changes when a flaw in one component lets the attacker affect another, such as breaking out of a virtual machine to its host. Confidentiality, integrity and availability record what is lost, each as none, low or high.
The base score describes the worst case for the flaw and nothing about your environment. FIRST says so in the specification: it is meant to be refined with temporal and environmental metrics. In practice, decide what to patch first from three things together: the score, whether the flaw is being exploited (the CISA Known Exploited Vulnerabilities catalog lists those that are), and whether the affected system is reachable and matters to you.
Write that rule down. An auditor will ask how long each severity is allowed to stay open, and the answer belongs in a patch management policy and a vulnerability assessment procedure, not in someone's memory.
CVSS v4.0 was published in November 2023 and uses different metrics. Vectors that begin with CVSS:4.0 are not scored here. Temporal and environmental metrics in a v3 vector are read past, and the result says which ones.
It is the eight metric choices written in a fixed order, for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. The vector is worth keeping beside the score in a report because it shows why the number is what it is.
9.0 to 10.0 is Critical, 7.0 to 8.9 is High, 4.0 to 6.9 is Medium and 0.1 to 3.9 is Low. The bands come from the CVSS v3.1 specification and are the same ones scanners and the National Vulnerability Database use.
The metrics and weights are the same. Version 3.1 clarified definitions and changed how rounding is defined, so that every implementation gives the same answer. A v3.0 vector pasted here is scored with the v3.1 formula.
The two sources chose different metric values, usually for scope, privileges required or attack complexity. Compare the two vectors, not the two numbers, and you will see which assumption differs.
No. It works out the base score only. If a pasted vector carries temporal or environmental metrics they are left out of the calculation and listed in the result.