CVSS Calculator
The CVSS v3.1 base score and severity rating of a vulnerability from its eight base metrics or a vector string, worked out exactly as the FIRST specification sets out.
Result…
How it's calculated
ISS = 1 − (1 − C)(1 − I)(1 − A) Impact = 6.42 × ISS (Scope Unchanged) Impact = 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)^15 (Scope Changed) Exploitability = 8.22 × AV × AC × PR × UI Base = Roundup(min(Impact + Exploitability, 10)), or Roundup(min(1.08 × (Impact + Exploitability), 10)) if Scope Changed; 0 if Impact ≤ 0
Scores a vulnerability with the Common Vulnerability Scoring System version 3.1, published by FIRST. Pick the eight base metrics or paste a vector string; the calculator gives the base score, the qualitative rating (None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0), the vector string and the sub-scores, using the specification’s weights and its integer-based Roundup function, so a score never comes out 0.1 too high from floating-point error.
Your numbers, step by step
About the CVSS calculator
This CVSS calculator gives the CVSS v3.1 base score of a software vulnerability, a number from 0.0 to 10.0, with its severity rating: None, Low, Medium, High or Critical. Pick the eight base metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and the Confidentiality, Integrity and Availability impacts) or paste a vector string such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Security teams use it to triage findings, write advisories and check scores in a report before passing them on. Every step follows the FIRST CVSS v3.1 specification: the weights from its metric table, the impact and exploitability equations, and its integer-based Roundup function. The working shows each value, so you can see why a score lands on 7.5 rather than 7.4.
How to use it
- Under “Start from”, choose “Pick the metrics” to use the drop-downs, or “Paste a vector string” to score a vector from an advisory.
- Set each metric, from “Attack Vector (AV)” to “Availability (A)”. “Scope (S)” is Changed when an attack on one component can affect another.
- Read the base score and the “Severity rating”, then copy the “Vector string” to record the metrics you chose.
- Open the working to see the ISS, Impact and Exploitability values and the Roundup step.
Worked example
A reflected cross-site scripting flaw: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. ISS = 1 − (1 − 0.22) × (1 − 0.22) × (1 − 0) = 0.3916. Scope is Changed, so Impact = 7.52 × (0.3916 − 0.029) − 3.25 × (0.3916 − 0.02)^15 ≈ 2.7. Exploitability = 8.22 × 0.85 × 0.77 × 0.85 × 0.62 ≈ 2.8. Base score = Roundup(1.08 × (Impact + Exploitability)) = 6.1, rated Medium.
Updated
Questions people ask
How is a CVSS v3.1 base score calculated?
Each metric value has a fixed weight. The three impact weights combine into the ISS, which gives the Impact; Attack Vector, Attack Complexity, Privileges Required and User Interaction multiply into Exploitability. The score is the sum, capped at 10, multiplied by 1.08 first if Scope is Changed, then rounded up to one decimal place.
What do the CVSS severity ratings mean?
The specification maps scores to words: 0.0 is None, 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High and 9.0 to 10.0 Critical. How quickly a rating must be fixed is up to each organisation's own policy.
What does the Roundup function do in CVSS?
It returns the smallest number with one decimal place that is equal to or higher than its input, so 4.02 becomes 4.1 and 4.00 stays 4.0. Version 3.1 works it out in whole numbers, so floating-point noise such as 4.000000001 cannot push a score up by 0.1.
Why does Privileges Required change weight when Scope is Changed?
The specification gives Low and High privileges higher weights (0.68 and 0.5 instead of 0.62 and 0.27) when the scope changes, because an attacker who needs privileges on one component can then reach others. A common mistake is using the unchanged weights for a changed-scope vector.
Is the base score the same as the risk to my organisation?
No. The base score describes the vulnerability on its own. Temporal metrics (exploit maturity, available fixes) and environmental metrics (how important the affected system is to you) adjust it. This calculator accepts them in a vector string but scores the base metrics only, and CVSS v4.0 uses different formulas. To check how long a password would take to guess, a separate question from vulnerability severity, see the password strength calculator.