The encyclopedia · Software & IT · Technical decision · 2003–2007
CVSS turned every vulnerability into one 0-10 score teams could prioritize
CVSS derives a 0-10 severity score from explicit metrics and encodes them in a vector string, giving vendors and incident teams one comparable number.
FIRST
the move
Before CVSS, vendors described vulnerability severity in different words and scales, so incident teams could not compare products or prioritize patches consistently. Research by the National Infrastructure Advisory Council in 2003 and 2004 asked for an open, universally standard severity rating.
CVSS version 1 launched in February 2005, designed to provide open and universally standard severity ratings of software vulnerabilities. In April 2005 FIRST took over development, and version 2 followed in 2007 after vendor feedback.
FIRST's own description says CVSS captures the principal characteristics of a vulnerability and produces a numerical score reflecting its severity, translatable into low, medium, high, and critical. Because the calculation is transparent and the standard is free, vulnerability databases and vendors adopted it as the common language of severity.
why it works
- A single 0-10 scale makes severity comparable across vendors and products.
- Explicit metrics replace subjective expert opinions.
- The vector string preserves the reasoning behind each score.
- Free, open maintenance by FIRST removed ownership barriers.
what transfers
When experts disagree on judgments, standardize the inputs: a score computed from explicit metrics is more defensible than an opinion, and comparability is what makes a rating system spread.
what came after
CVSS became the standard severity scale in vulnerability management, used by NVD, vendor advisories, and incident response teams; versions 3.x and 4.0 extended the metric model while keeping the 0-10 output.
references
spotted an error? The archive wants to know.