In more detail
A score is calculated from metrics such as attack vector, complexity, privileges required, user interaction and the impact on confidentiality, integrity and availability. Ratings run from Low (0.1-3.9) to Critical (9.0-10.0); Medium is 4.0-6.9, High 7.0-8.9 and 0.0 means None. The base score describes the flaw itself, not your own risk. Version 3.1 is still the most widely published; CVSS 4.0, released by FIRST in 2023, adds metrics such as attack requirements and separates impact on the vulnerable system from impact on others. Scores are written as a vector string so anyone can recompute them.
Why it matters
Teams use the score to triage patches, but a 9.8 on a system that is not exposed can matter less than a 6.5 on your login page. Combine the base score with exposure, whether the flaw is being exploited in the wild, and the value of the asset. Always check which CVSS version a score uses, because 3.1 and 4.0 values are not interchangeable. See the CVSS Metrics Cheat Sheet.
Example
Three CVSS 3.1 vectors and their base scores:
| Vector | Score |
|---|---|
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (remote, no login) |
9.8 Critical |
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (local user) |
7.8 High |
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (typical reflected XSS) |
6.1 Medium |
Change one metric at a time in the CVSS Calculator to see how the score moves.