Vulnerability CVSS Score Calculator

Scope Changed means the vulnerable component's security authority is being bypassed to affect a different component, so FIRST's specification treats privileges required as easier to leverage in that scenario -- the weights for Low and High privileges are higher under Scope Changed (0.68 and 0.50) than Scope Unchanged (0.62 and 0.27). It also swaps in an entirely different impact formula with different constants (7.52 and a subtracted power term instead of a flat 6.42 multiplier), which is why Scope Changed vulnerabilities can score noticeably higher than Scope Unchanged ones with identical CIA impact settings.

The impact sub-score combines Confidentiality, Integrity, and Availability using 1 minus the product of their complements, not a simple sum or average. Three High impacts (each weighted 0.56) produce 1 - (1-0.56)^3 = 0.915, which is close to but not the same as adding them -- and one High plus two None impacts produces only 0.56, since None contributes a weight of zero and doesn't average things upward.

CVSS v3.1's official specification always rounds the base score up to the nearest tenth, never to the nearest tenth -- this calculator implements that with Math.ceil rather than Math.round, matching the FIRST.org reference formula exactly. It's a deliberate scoring convention meant to avoid ever underrepresenting severity through rounding.

No -- it's a practical starting point (24 hours for Critical down to 30 days for Low) based on common industry practice, not a mandated standard from FIRST.org or any regulator. Your actual SLA should also weigh compensating controls, exploit availability, and asset criticality, none of which the CVSS Base Score alone captures since it deliberately excludes Temporal and Environmental metrics.