Glossary
CVSS
A standard for describing and scoring the intrinsic characteristics of a vulnerability, from 0 to 10, independently of where it is installed.
- Common Vulnerability Scoring System
CVSS breaks a vulnerability down into attack vector, complexity, privileges required, user interaction and impact on confidentiality, integrity and availability. The result is a score comparable across products and teams, which is its real virtue.
Its limitation lies in the part almost nobody uses. The score shipped with the CVE is only the base; the standard includes further metric groups — threat and environmental in CVSS v4.0, temporal and environmental in v3.1 — designed precisely to capture whether exploit code exists and what the asset is worth in your organisation. When someone says “we prioritise by CVSS”, they usually mean they prioritise by somebody else’s base score: a deliberately decontextualised metric.
Always publish the full vector alongside the number. An “8.1” with no vector cannot be challenged or recalculated; with the vector, anyone can adjust the environmental metrics and reach their own conclusion.