HuntsvilleEngineers mark
Subscribe

CVSS v3.1 Base Score

Score a vulnerability from its eight base metrics — exact FIRST.org v3.1 math including the Roundup quirk.

InputISS = 1 − (1−C)(1−I)(1−A) Impact(U) = 6.42·ISS Impact(C) = 7.52·(ISS−0.029) − 3.25·(ISS−0.02)¹⁵ Expl = 8.22·AV·AC·PR·UI Score = Roundup(min(Impact + Expl, 10)) (×1.08 before min if Scope Changed)

Your recent runs (stored only in your browser)

No calculations yet — results land here so you can compare runs.

The engineering

The CVSS base score compresses a vulnerability's intrinsic severity into a 0–10 number from eight enumerated metrics: four exploitability metrics (how hard is it to reach and trigger), the Scope flag (does the exploit break out of the vulnerable component's security authority), and three impact metrics (what happens to confidentiality, integrity, availability). This card runs the exact FIRST.org v3.1 equations — including the scope-dependent Privileges Required values (L jumps 0.62 → 0.68, H jumps 0.27 → 0.50 when Scope is Changed) and the spec's integer-safe Roundup function, which ceilings to one decimal rather than rounding.

Sanity checks: the classic wormable RCE (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is 9.8, and no unchanged-scope vector can hit 10.0 — only Scope Changed with its 1.08 multiplier gets there. If your hand calc disagrees with NVD by exactly 0.1, you almost certainly rounded where the spec says Roundup: 4.02 becomes 4.1, not 4.0.

Remember what the base score is not: it carries no exploit-maturity, patch-availability, or asset-criticality information. Those live in the Temporal and Environmental metric groups. Triage on the base score; prioritize with context.

Where this math comes from

CVSS started as a homeland-security problem, not a vendor one. In 2003–2005 the US National Infrastructure Advisory Council, frustrated that every scanner and vendor scored vulnerabilities on incompatible scales, chartered a common scoring system; version 1 shipped in February 2005 and custodianship was handed to FIRST, the Forum of Incident Response and Security Teams. Version 2 (2007) fixed granularity problems, and the empirically-tuned constants in this card — 8.22, 6.42, 7.52, the 15th-power term — arrived with v3.0 in 2015, fitted so that a panel of practitioners' severity judgments landed on the intended 0–10 spots.

Version 3.1, published June 2019, changed no metric values at all. It existed largely to kill implementation drift: floating-point Roundup behavior differed between calculators enough to flip scores by 0.1, so the spec's Appendix A published the exact integer-arithmetic function this card uses. CVSS v4.0 followed in November 2023, but v3.1 remains what NVD, most PSIRTs, and most contract SLAs actually cite.

  1. 2005NIACCVSS v1 published; stewardship transferred to FIRST.
  2. 2007FIRST CVSS SIGv2 released — the scheme NVD scored against for eight years.
  3. 2015FIRST CVSS SIGv3.0 adds Scope, User Interaction, and the current equation constants.
  4. 2019FIRST CVSS SIGv3.1 pins the Roundup function to end floating-point scoring drift.
  5. 2023FIRST CVSS SIGv4.0 published; v3.1 remains the de facto NVD baseline.

See the full timeline of the math behind every calculator →

Runs entirely in your browser — nothing you enter leaves this page. Your recent runs are stored only on your device.