OneTaskBy Tim King · Updated
CVSS Calculator
Eight Base Metrics or Pasted Vector, With Impact and Exploitability Subscores
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the CVSS Calculator works
This CVSS calculator gives the CVSS 3.1 base score for a vulnerability. Pick the eight base metrics, or paste a vector string such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and it shows the score, the severity rating and the vector to copy into a report or ticket.
How the CVSS calculator scores a vulnerability
The Common Vulnerability Scoring System describes a flaw with eight base metrics. Four cover how it is exploited: the attack vector, how complex the attack is, what privileges the attacker needs and whether a user has to do something. Scope says whether the attack can reach beyond the vulnerable component. The last three rate the damage to confidentiality, integrity and availability.
The calculator follows the FIRST specification for version 3.1. It works out an impact subscore and an exploitability subscore, combines them with the scope rule and rounds up to one decimal place using the specification's own rounding function. The result falls into a band: None at 0.0, Low up to 3.9, Medium up to 6.9, High up to 8.9 and Critical from 9.0.
A base score describes the flaw itself, not your exposure to it. A critical score on a system that is not reachable from the internet may matter less to you than a medium one on your login page, so use it to sort work, alongside what you know about your own systems.
CVSS 3.1 base score formula
ISS = 1 − (1 − C) × (1 − I) × (1 − A) Impact = 6.42 × ISS when scope is unchanged, or 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)^15 when it changes Exploitability = 8.22 × AV × AC × PR × UI Base score = Impact + Exploitability, capped at 10 and rounded up to one decimal (× 1.08 first if scope changes)
The weights are AV N 0.85, A 0.62, L 0.55, P 0.2; AC L 0.77, H 0.44; PR N 0.85, L 0.62, H 0.27; UI N 0.85, R 0.62; and C, I, A H 0.56, L 0.22, N 0. If impact is zero the score is 0.0.
Worked example: remote code execution
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H gives ISS 0.915, impact 5.87 and exploitability 3.89. The sum is 9.76, which rounds up to 9.8 Critical.
Worked example: local information leak
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N gives ISS 0.56, impact 3.60 and exploitability 1.83. The sum is 5.43, which rounds up to 5.5 Medium.
CVSS score reference table
Base scores for common CVSS 3.1 vectors.
| Vector | Base score | Severity |
|---|---|---|
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
9.8 | Critical |
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
10.0 | Critical |
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
8.8 | High |
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
7.2 | High |
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
8.1 | High |
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
8.8 | High |
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
6.1 | Medium |
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
6.4 | Medium |
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
7.5 | High |
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
7.5 | High |
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
5.3 | Medium |
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
6.5 | Medium |
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
4.3 | Medium |
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
7.5 | High |
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
8.8 | High |
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
7.8 | High |
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
5.5 | Medium |
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
7.8 | High |
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
7.0 | High |
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
6.8 | Medium |
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
4.6 | Medium |
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N |
0.0 | None |
Quick answers
- 9.0 to 10.0 is Critical, 7.0 to 8.9 High, 4.0 to 6.9 Medium and 0.1 to 3.9 Low.
- Needing a user to click drops a 9.8 to 8.8.
- A changed scope pushes a network 9.8 to 10.0.
- Physical access (AV:P) caps most flaws at Medium.
- To see how many points a metric is worth, change one letter in the vector and compare the scores.
FAQ
What is a CVSS vector string?
It is a compact record of the metrics, such as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, starting with the version. Anyone can paste it into a calculator and get the same score, so it travels with advisories.
Does it support CVSS 4.0?
No, it scores version 3.1, which is still the version most advisories and scanners publish. A 3.0 vector is accepted too, since the metrics are the same, and it is scored with the 3.1 rules.
Why does changing scope raise the score?
A changed scope means the attack breaks out of the vulnerable component into others, such as escaping a sandbox or a virtual machine. The formula weights impact more heavily and raises the privileges values.
Is the base score the final score?
It is the starting point. CVSS also defines threat and environmental metrics that adjust the score for known exploits and for how important the affected system is to you. Most public databases show only base.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
CVE ID Validator
Check a list of CVE IDs for format errors and duplicates.
OWASP Top 10 Reference
The OWASP Top 10 web risks with plain explanations and fixes.
Security Headers Checker
Check pasted response headers for missing, weak and leaky security headers.
Incident Response Checklist
A step-by-step checklist for the security incident you are facing.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.