Free CVSS Calculator for CVSS v4.0, v3.1, v3.0 and v2.0

API Docs

AI Scorer CVE Search

Show explanations

Base Metrics

Required

Access Vector (AV)

From where can an attacker exploit it?

Local (L)

0.395

Adjacent Network (A)

0.646

Network (N)

1.0

The attacker needs physical access or a local account on the machine.

Access Complexity (AC)

How hard is the attack to pull off?

High (H)

0.35

Medium (M)

0.61

Low (L)

0.71

Needs special, rare conditions (e.g. winning a race condition or tricking a specific user).

Authentication (Au)

Does the attacker have to log in first?

Multiple (M)

0.45

Single (S)

0.56

None (N)

0.704

The attacker has to log in twice or more, even with the same credentials.

Confidentiality Impact (C)

Can the attacker read data they shouldn't?

None (N)

0.0

Partial (P)

0.275

Complete (C)

0.66

No information is disclosed.

Integrity Impact (I)

Can the attacker change or delete data?

None (N)

0.0

Partial (P)

0.275

Complete (C)

0.66

Nothing can be modified.

Availability Impact (A)

Can the attacker slow down or stop the system?

None (N)

0.0

Partial (P)

0.275

Complete (C)

0.66

The system keeps working normally.

Temporal Metrics

Optional

Exploitability

Is there working attack code out there?

Unproven (U)

0.85

Proof of Concept (POC)

0.9

Functional (F)

0.95

High (H)

1.0

Not Defined (ND)

1.0

Not evaluated: the score is not adjusted.

Remediation Level

Is a fix available?

Official Fix (OF)

0.87

Temporary Fix (TF)

0.9

Workaround (W)

0.95

Unavailable (U)

1.0

Not Defined (ND)

1.0

Not evaluated: the score is not adjusted.

Report Confidence

How sure are we that the vulnerability is real?

Unconfirmed (UC)

0.9

Uncorroborated (UR)

0.95

Confirmed (C)

1.0

Not Defined (ND)

1.0

Not evaluated: the score is not adjusted.

Environmental Metrics

Optional

Collateral Damage Potential

How much damage could an attack cause to your organisation?

None (N)

0.0

Low (L)

0.1

Low-Medium (LM)

0.3

Medium-High (MH)

0.4

High (H)

0.5

Not Defined (ND)

0.0

Not evaluated: the score is not adjusted.

Target Distribution

How many of your systems are affected?

None (N)

0.0

Low (L)

0.25

Medium (M)

0.75

High (H)

1.0

Not Defined (ND)

1.0

Not evaluated: the score is not adjusted.

Confidentiality Requirement

How important is keeping this system's data secret for you?

Low (L)

0.5

Medium (M)

1.0

High (H)

1.51

Not Defined (ND)

1.0

Not evaluated: treated as Medium.

Integrity Requirement

How important is it that this system's data stays correct?

Low (L)

0.5

Medium (M)

1.0

High (H)

1.51

Not Defined (ND)

1.0

Not evaluated: treated as Medium.

Availability Requirement

How important is it that this system stays up?

Low (L)

0.5

Medium (M)

1.0

High (H)

1.51

Not Defined (ND)

1.0

Not evaluated: treated as Medium.

Impact

Exploitability

Auto-calculation enabled

Base Metrics

Required

Attack Vector (AV)

From where can an attacker exploit it?

Network (N)

0.85

Adjacent (A)

0.62

Local (L)

0.55

Physical (P)

0.2

Exploitable remotely, e.g. over the Internet. This is the most dangerous case.

Attack Complexity (AC)

Does the attack depend on conditions outside the attacker's control?

Low (L)

0.77

High (H)

0.44

No special conditions: the attack works reliably, whenever the attacker wants.

Privileges Required (PR)

Does the attacker need an account on the system first?

None (N)

0.85

Low (L)

0.62

High (H)

0.27

No account needed: anyone who can reach the system can attack it.

User Interaction (UI)

Does someone other than the attacker have to do something?

None (N)

0.85

Required (R)

0.62

No victim action needed: the attacker can do it all alone.

Scope (S)

Can the attack spread beyond the vulnerable component?

Unchanged (U)

Changed (C)

Only the vulnerable component itself (and what it manages) is affected.

Confidentiality Impact (C)

Can the attacker read data they shouldn't?

None (N)

0.0

Low (L)

0.22

High (H)

0.56

No information is disclosed.

Integrity Impact (I)

Can the attacker change or delete data?

None (N)

0.0

Low (L)

0.22

High (H)

0.56

Nothing can be modified.

Availability Impact (A)

Can the attacker slow down or stop the system?

None (N)

0.0

Low (L)

0.22

High (H)

0.56

The system keeps working normally.

Temporal Metrics

Optional

Exploit Code Maturity

Is there working attack code out there?

Not Defined (X)

1.0

Unproven (U)

0.91

Proof of Concept (P)

0.94

Functional (F)

0.97

High (H)

1.0

Not evaluated: the score is not adjusted (same as High).

Remediation Level

Is a fix available?

Not Defined (X)

1.0

Official Fix (O)

0.95

Temporary Fix (T)

0.96

Workaround (W)

0.97

Unavailable (U)

1.0

Not evaluated: the score is not adjusted.

Report Confidence

How sure are we that the vulnerability is real?

Not Defined (X)

1.0

Unknown (U)

0.92

Reasonable (R)

0.96

Confirmed (C)

1.0

Not evaluated: the score is not adjusted.

Environmental Metrics

Optional

Confidentiality Requirement

How important is keeping this system's data secret for you?

Not Defined (X)

1.0

Low (L)

0.5

Medium (M)

1.0

High (H)

1.5

Not evaluated: treated as Medium.

Integrity Requirement

How important is it that this system's data stays correct?

Not Defined (X)

1.0

Low (L)

0.5

Medium (M)

1.0

High (H)

1.5

Not evaluated: treated as Medium.

Availability Requirement

How important is it that this system stays up?

Not Defined (X)

1.0

Low (L)

0.5

Medium (M)

1.0

High (H)

1.5

Not evaluated: treated as Medium.

Modified Attack Vector

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

Network (N)

0.85

Adjacent (A)

0.62

Local (L)

0.55

Physical (P)

0.2

Keep the base value for your environment.

Modified Attack Complexity

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

Low (L)

0.77

High (H)

0.44

Keep the base value for your environment.

Modified Privileges Required

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.85

Low (L)

0.62

High (H)

0.27

Keep the base value for your environment.

Modified User Interaction

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.85

Required (R)

0.62

Keep the base value for your environment.

Modified Scope

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

Unchanged (U)

Changed (C)

Keep the base value for your environment.

Modified Confidentiality

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.0

Low (L)

0.22

High (H)

0.56

Keep the base value for your environment.

Modified Integrity

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.0

Low (L)

0.22

High (H)

0.56

Keep the base value for your environment.

Modified Availability

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.0

Low (L)

0.22

High (H)

0.56

Keep the base value for your environment.

Impact

Exploitability

Auto-calculation enabled

Base Metrics

Required

Attack Vector (AV)

From where can an attacker exploit it?

Network (N)

0.85

Adjacent (A)

0.62

Local (L)

0.55

Physical (P)

0.2

Exploitable remotely, e.g. over the Internet. This is the most dangerous case.

Attack Complexity (AC)

Does the attack depend on conditions outside the attacker's control?

Low (L)

0.77

High (H)

0.44

No special conditions: the attack works reliably, whenever the attacker wants.

Privileges Required (PR)

Does the attacker need an account on the system first?

None (N)

0.85

Low (L)

0.62

High (H)

0.27

No account needed: anyone who can reach the system can attack it.

User Interaction (UI)

Does someone other than the attacker have to do something?

None (N)

0.85

Required (R)

0.62

No victim action needed: the attacker can do it all alone.

Scope (S)

Can the attack spread beyond the vulnerable component?

Unchanged (U)

Changed (C)

Only the vulnerable component itself (and what it manages) is affected.

Confidentiality Impact (C)

Can the attacker read data they shouldn't?

None (N)

0.0

Low (L)

0.22

High (H)

0.56

No information is disclosed.

Integrity Impact (I)

Can the attacker change or delete data?

None (N)

0.0

Low (L)

0.22

High (H)

0.56

Nothing can be modified.

Availability Impact (A)

Can the attacker slow down or stop the system?

None (N)

0.0

Low (L)

0.22

High (H)

0.56

The system keeps working normally.

Temporal Metrics

Optional

Exploit Code Maturity

Is there working attack code out there?

Not Defined (X)

1.0

Unproven (U)

0.91

Proof of Concept (P)

0.94

Functional (F)

0.97

High (H)

1.0

Not evaluated: the score is not adjusted (same as High).

Remediation Level

Is a fix available?

Not Defined (X)

1.0

Official Fix (O)

0.95

Temporary Fix (T)

0.96

Workaround (W)

0.97

Unavailable (U)

1.0

Not evaluated: the score is not adjusted.

Report Confidence

How sure are we that the vulnerability is real?

Not Defined (X)

1.0

Unknown (U)

0.92

Reasonable (R)

0.96

Confirmed (C)

1.0

Not evaluated: the score is not adjusted.

Environmental Metrics

Optional

Confidentiality Requirement

How important is keeping this system's data secret for you?

Not Defined (X)

1.0

Low (L)

0.5

Medium (M)

1.0

High (H)

1.5

Not evaluated: treated as Medium.

Integrity Requirement

How important is it that this system's data stays correct?

Not Defined (X)

1.0

Low (L)

0.5

Medium (M)

1.0

High (H)

1.5

Not evaluated: treated as Medium.

Availability Requirement

How important is it that this system stays up?

Not Defined (X)

1.0

Low (L)

0.5

Medium (M)

1.0

High (H)

1.5

Not evaluated: treated as Medium.

Modified Attack Vector

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

Network (N)

0.85

Adjacent (A)

0.62

Local (L)

0.55

Physical (P)

0.2

Keep the base value for your environment.

Modified Attack Complexity

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

Low (L)

0.77

High (H)

0.44

Keep the base value for your environment.

Modified Privileges Required

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.85

Low (L)

0.62

High (H)

0.27

Keep the base value for your environment.

Modified User Interaction

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.85

Required (R)

0.62

Keep the base value for your environment.

Modified Scope

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

Unchanged (U)

Changed (C)

Keep the base value for your environment.

Modified Confidentiality

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.0

Low (L)

0.22

High (H)

0.56

Keep the base value for your environment.

Modified Integrity

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.0

Low (L)

0.22

High (H)

0.56

Keep the base value for your environment.

Modified Availability

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

0.0

Low (L)

0.22

High (H)

0.56

Keep the base value for your environment.

Impact

Exploitability

Auto-calculation enabled

CVSS v4.0 — What's New!

New model with supplemental metrics and focus on Subsequent Systems

Base Metrics

Required

Attack Vector (AV)

From where can an attacker exploit it?

Network (N)

Adjacent (A)

Local (L)

Physical (P)

Exploitable remotely, e.g. over the Internet. This is the most dangerous case.

Attack Complexity (AC)

Does the attacker have to defeat security protections?

Low (L)

High (H)

No protections to work around: the attack works reliably.

Attack Requirements (AT)

Does the attack only work in particular situations?

None (N)

Present (P)

Works on any vulnerable system, regardless of how it is set up.

Privileges Required (PR)

Does the attacker need an account on the system first?

None (N)

Low (L)

High (H)

No account needed: anyone who can reach the system can attack it.

User Interaction (UI)

Does someone other than the attacker have to do something?

None (N)

Passive (P)

Active (A)

No victim action needed: the attacker can do it all alone.

Confidentiality (Vulnerable)

Can the attacker read data on the vulnerable system?

None (N)

Low (L)

High (H)

No information is disclosed.

Integrity (Vulnerable)

Can the attacker change data on the vulnerable system?

None (N)

Low (L)

High (H)

Nothing can be modified.

Availability (Vulnerable)

Can the attacker slow down or stop the vulnerable system?

None (N)

Low (L)

High (H)

The system keeps working normally.

Confidentiality (Subsequent)

Can the attack expose data on other systems too?

None (N)

Low (L)

High (H)

No other systems are affected.

Integrity (Subsequent)

Can the attack change data on other systems too?

None (N)

Low (L)

High (H)

No other systems are affected.

Availability (Subsequent)

Can the attack take other systems down too?

None (N)

Low (L)

High (H)

No other systems are affected.

Threat Metrics

Optional

Exploit Maturity

Is this vulnerability being attacked, or is attack code public?

Not Defined (X)

Attacked (A)

Proof of Concept (P)

Unreported (U)

Not evaluated: assumed to be the worst case (Attacked).

Environmental Metrics

Optional

Confidentiality Requirement

How important is keeping this system's data secret for you?

Not Defined (X)

Low (L)

Medium (M)

High (H)

Not evaluated: treated as High (worst case).

Integrity Requirement

How important is it that this system's data stays correct?

Not Defined (X)

Low (L)

Medium (M)

High (H)

Not evaluated: treated as High (worst case).

Availability Requirement

How important is it that this system stays up?

Not Defined (X)

Low (L)

Medium (M)

High (H)

Not evaluated: treated as High (worst case).

Modified Attack Vector

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

Network (N)

Adjacent (A)

Local (L)

Physical (P)

Keep the base value for your environment.

Modified Attack Complexity

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

Low (L)

High (H)

Keep the base value for your environment.

Modified Attack Requirements

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

Present (P)

Keep the base value for your environment.

Modified Privileges Required

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

Low (L)

High (H)

Keep the base value for your environment.

Modified User Interaction

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

Passive (P)

Active (A)

Keep the base value for your environment.

Modified Confidentiality

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

Low (L)

High (H)

Keep the base value for your environment.

Modified Integrity

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

Low (L)

High (H)

Keep the base value for your environment.

Modified Availability

Different in your environment? Leave “Not Defined” to keep the base value.

Not Defined (X)

None (N)

Low (L)

High (H)

Keep the base value for your environment.

Modified Confidentiality (Subsequent)

Is the impact on other systems' data secrecy different in your environment?

Not Defined (X)

Negligible (N)

Low (L)

High (H)

Keep the base value.

Modified Integrity (Subsequent)

Is the impact on other systems' data different in your environment?

Not Defined (X)

Negligible (N)

Low (L)

High (H)

Safety (S)

Keep the base value.

Modified Availability (Subsequent)

Is the impact on other systems' uptime different in your environment?

Not Defined (X)

Negligible (N)

Low (L)

High (H)

Safety (S)

Keep the base value.

Supplemental Metrics

Optional

Safety

Could exploiting it put people's physical safety at risk?

Not Defined (X)

Negligible (N)

Present (P)

Not evaluated.

Automatable

Could the attack be automated at scale?

Not Defined (X)

No (N)

Yes (Y)

Not evaluated.

Recovery

How easily does the system recover after an attack?

Not Defined (X)

Automatic (A)

User (U)

Irrecoverable (I)

Not evaluated.

Value Density

How much does an attacker gain with a single successful attack?

Not Defined (X)

Diffuse (D)

Concentrated (C)

Not evaluated.

Response Effort

How hard is it for you to respond to it?

Not Defined (X)

Low (L)

Moderate (M)

High (H)

Not evaluated.

Provider Urgency

How urgent does the vendor say it is?

Not Defined (X)

Clear

Green

Amber

Red

Not evaluated.

Impact

Exploitability

Auto-calculation enabled

CVSS Converter

From Version

To Version

Vector String

Version detected:

Quick Examples

CVSS Severity Levels

None

0.0

No vulnerability

Low

0.1 - 3.9

Low risk, difficult to exploit

Medium

4.0 - 6.9

Moderate risk

High

7.0 - 8.9

High risk, easy to exploit

Critical

9.0 - 10.0

Critical risk, immediate action