CVSS

CVSS, the Common Vulnerability Scoring System, is maintained by FIRST and turns a set of declared characteristics into a number between 0.0 and 10.0. The base metrics describe the properties that do not change with circumstance: how the flaw is reached, how much complexity and privilege an attack requires, whether a user has to be involved, and what it costs in confidentiality, integrity and availability. Temporal metrics, renamed threat metrics in version 4.0, adjust for the state of the world, such as whether working exploit code is circulating. Environmental metrics let you re-score the same flaw for your own deployment, weighted by how much each impact matters to you and by the controls already in place.

Scores map onto the qualitative ratings most reporting uses: none, low, medium, high and critical. Those labels are what turns a score into a plan, because a remediation queue ordered by number alone treats every system in an estate as equally important. The commercial value of the standard is that it gives two parties a shared vocabulary for arguing about a finding. Its limit is that a base score deliberately knows nothing about your business, so a critical rating on something nobody can reach and a medium rating on your payment path can be exactly the wrong way round.

Using a score without being governed by it

• Read the vector string rather than only the number. It states the assumptions the score was built on, and it is usually where a disagreement about severity gets settled.
• Apply the environmental metrics before planning any work. A vulnerability sitting behind an internal network boundary is a different risk from the same one on a public endpoint.
• Keep exploitability separate from severity. Whether something is being exploited in the wild belongs in the threat metrics, and it is what should change your plans this week.
• Do not treat a published base score as your work queue. Whether the vulnerable path is reachable in your own code decides what gets fixed first, and that is a question about your architecture.

A base score measures the flaw and not your exposure to it, which is precisely why the environmental metrics exist.