The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r. Use when working with prioritizing vulnerabilities with cvss scoring.
The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r. Use when working with prioritizing vulnerabilities with cvss scoring.
The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (released November 2023) introduces refined metrics for more accurate scoring. This skill covers calculating CVSS scores, interpreting vector strings, and using CVSS alongside contextual factors like EPSS and CISA KEV for effective vulnerability prioritization.
Anti-Rationalization Table
Rationalization
Reality
"I'll figure it out as I go"
A structured approach saves time and reduces errors. Follow the workflow in this skill rather than improvising.
"I already know this topic"
Familiarity breeds shortcuts. Use the checklist to verify you haven't missed critical steps.
"This doesn't apply to my situation"
The patterns here generalize across contexts. Adapt, don't skip — the underlying principles hold.
"One more tool will fix it"
Adding complexity rarely solves process gaps. Master the core workflow first.
When to Use
Trigger phrases:
"prioritizing vulnerabilities with cvss scoring"
"The Common Vulnerability Scoring System (CVSS) is the industry standard framewor"
When managing security operations that require prioritizing vulnerabilities with cvss scoring
When improving security program maturity and operational processes
When establishing standardized procedures for security team workflows
When integrating threat intelligence or vulnerability data into operations
Prerequisites
Understanding of common vulnerability types (buffer overflow, injection, XSS, etc.)
Familiarity with networking concepts (attack vectors, protocols)
Access to NVD (National Vulnerability Database) for CVE lookups
This example represents a network-exploitable vulnerability requiring no privileges, no user interaction, no attack requirements, with high impact on confidentiality, integrity, and availability of the vulnerable system.
Workflow
Scope the task — define objectives, boundaries, and success criteria
Gather information — collect all necessary data and context before proceeding
Execute the core workflow — follow the domain-specific steps methodically
Validate results — verify outputs against expected outcomes or baselines
Document findings — record results, anomalies, and recommendations
Step 1: Assess Base Metrics
For each vulnerability, evaluate:
Example: CVE-2024-3094 (XZ Utils Backdoor)
Attack Vector: Network (N) - Exploitable over network
Attack Complexity: High (H) - Specific conditions required
Attack Requirements: Present (P) - Specific build/config needed
Privileges Required: None (N) - No authentication needed
User Interaction: None (N) - No victim action needed
Vulnerable System Impact:
Confidentiality: High (H) - Complete access to SSH keys
Integrity: High (H) - Arbitrary code execution
Availability: High (H) - Full system compromise
Subsequent System Impact:
Confidentiality: High (H) - Lateral movement possible
Integrity: High (H) - Network-wide compromise
Availability: None (N) - No downstream availability impact
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
Step 2: Apply Threat Intelligence Context
Enrich CVSS with real-world threat data:
Exploit Maturity: Attacked (A) - Active exploitation in the wild
EPSS Score: 0.94 - 94% probability of exploitation in 30 days
CISA KEV: Listed - Mandatory remediation for federal agencies
Step 3: Calculate Environmental Score
Adjust for organizational context:
Confidentiality Req: High (H) - Handles PII/financial data
Integrity Req: High (H) - Critical business process
Availability Req: Medium (M) - Has DR/failover capability
Modified Attack Vector: Network (N) - Internet-facing deployment
Step 4: Multi-Factor Prioritization Matrix
Combine CVSS with additional prioritization factors:
Factor
Weight
Source
CVSS Base Score
25%
NVD/Scanner
EPSS Score
25%
FIRST EPSS API
Asset Criticality
20%
Asset inventory/CMDB
CISA KEV Listed
15%
CISA catalog
Network Exposure
15%
Network segmentation data
Step 5: Define Remediation SLAs
Priority Level
CVSS Range
EPSS
Asset Tier
SLA
P1 - Emergency
9.0-10.0
>0.5
Tier 1
24-48 hours
P2 - Critical
7.0-8.9
>0.3
Tier 1-2
7 days
P3 - High
7.0-8.9
<0.3
Tier 2-3
14 days
P4 - Medium
4.0-6.9
Any
Any
30 days
P5 - Low
0.1-3.9
Any
Any
90 days
Best Practices
Never rely solely on CVSS base score for prioritization
