Skip to content
CVSS.my.id

CVSS v3.1 Reference

CVSS v3.1 (published June 2019) clarifies guidance from v3.0, refines the Environmental ModifiedImpact formula for Scope Changed (MS:C), and defines the exact floating-point safe Roundup function in Appendix A (roundup(x) = ceil(round_to_nearest_int(x * 100000) / 10000) / 10).

Open the CVSS v3.1 Calculator.

Base Metrics (8 Mandatory)

MetricCodeValues
Attack VectorAVN (Network = 0.85), A (Adjacent = 0.62), L (Local = 0.55), P (Physical = 0.20)
Attack ComplexityACL (Low = 0.77), H (High = 0.44)
Privileges RequiredPRN (None = 0.85), L (Low = 0.62 when S:U, 0.68 when S:C), H (High = 0.27 when S:U, 0.50 when S:C)
User InteractionUIN (None = 0.85), R (Required = 0.62)
ScopeSU (Unchanged), C (Changed)
ConfidentialityCN (None = 0.00), L (Low = 0.22), H (High = 0.56)
IntegrityIN (None = 0.00), L (Low = 0.22), H (High = 0.56)
AvailabilityAN (None = 0.00), L (Low = 0.22), H (High = 0.56)

Temporal Metrics (3 Optional)

When omitted or set to X (Not Defined), each Temporal metric defaults to a weight of 1.00:

  • Exploit Code Maturity (E): X (1.00), U (Unproven = 0.91), P (Proof-of-Concept = 0.94), F (Functional = 0.97), H (High = 1.00)
  • Remediation Level (RL): X (1.00), O (Official Fix = 0.95), T (Temporary Fix = 0.96), W (Workaround = 0.97), U (Unavailable = 1.00)
  • Report Confidence (RC): X (1.00), U (Unknown = 0.92), R (Reasonable = 0.96), C (Confirmed = 1.00)

Environmental Metrics (11 Optional)

  • Security Requirements (CR, IR, AR): X (1.0), L (Low = 0.5), M (Medium = 1.0), H (High = 1.5).
  • Modified Base Metrics (MAV, MAC, MPR, MUI, MS, MC, MI, MA): Override the corresponding Base metric when set to any value other than X (Not Defined).

Exact Formulas (CVSS v3.1)

Base Score

  1. ISS = 1 - ((1 - C) * (1 - I) * (1 - A))
  2. If S == U: Impact = 6.42 * ISS
  3. If S == C: Impact = 7.52 * (ISS - 0.029) - 3.25 * (ISS - 0.02)^15
  4. Exploitability = 8.22 * AV * AC * PR * UI
  5. If Impact <= 0, BaseScore = 0.0.
  6. Otherwise:
    • If S == U: BaseScore = Roundup(min(Impact + Exploitability, 10))
    • If S == C: BaseScore = Roundup(min(1.08 * (Impact + Exploitability), 10))

Temporal Score

TemporalScore = Roundup(BaseScore * E * RL * RC)

Environmental Score (v3.1 Specific)

  1. MISS = min(1 - (1 - MC * CR) * (1 - MI * IR) * (1 - MA * AR), 0.915)
  2. If MS == U: ModifiedImpact = 6.42 * MISS
  3. If MS == C: ModifiedImpact = 7.52 * (MISS - 0.029) - 3.25 * (MISS * 0.9731 - 0.02)^13
  4. ModifiedExploitability = 8.22 * MAV * MAC * MPR * MUI
  5. If ModifiedImpact <= 0, EnvironmentalScore = 0.0.
  6. Otherwise:
    • If MS == U: EnvironmentalScore = Roundup(Roundup(min(ModifiedImpact + ModifiedExploitability, 10)) * E * RL * RC)
    • If MS == C: EnvironmentalScore = Roundup(Roundup(min(1.08 * (ModifiedImpact + ModifiedExploitability), 10)) * E * RL * RC)