ITInfoByte
Search tools/

CVSS Calculator (v3.1 and v4.0)

Choose a value for each metric, or paste a vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and the score and severity update as you go. Version 3.1 uses the formulas from the FIRST specification; version 4.0 uses FIRST's MacroVector lookup method and gives the same results as FIRST's reference calculator. Nothing is sent to a server.

Runs locally — nothing you enter is sent Security Free · no signup
CVSS version
0.0
None
CVSS score
Pick a value for each metric, or paste a vector string.

Base metrics

Temporal metrics (optional)
Environmental metrics (optional)

The note under each metric describes the value selected; hover a value to read its description before choosing it. Scores are worked out on this page with the FIRST formulas; nothing is sent anywhere.

How to use

  1. Pick CVSS v3.1 or CVSS v4.0 at the top. Each version keeps its own selections, so you can switch back and forth.
  2. Choose a value for every base metric. The note under each metric explains the value you picked.
  3. Optionally open the temporal (v3.1) or threat (v4.0) and environmental groups to adjust the score for exploit maturity and for your own environment.
  4. Or paste a vector string into the box and click Load vector (or press Enter). Errors such as an unknown metric, a duplicate or a missing base metric are listed in the status line.
  5. Copy the vector, or click Copy link to share a URL that opens this page with the same vector loaded.

Examples

Log4Shell (CVE-2021-44228), v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0 Critical
Typical reflected XSS, v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 Medium
v3.1 with temporal metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Base 9.8, Temporal 8.8 High
Unauthenticated remote takeover, v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.3 Critical (CVSS-B, MacroVector 000200)
Same v4.0 vector, no public exploit
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
8.1 High (CVSS-BT)
Local privilege escalation, v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.5 High

Supported formats

  • CVSS v3.1 vectors (CVSS:3.1/AV:…/AC:…/PR:…/UI:…/S:…/C:…/I:…/A:…, then optional E, RL, RC, CR, IR, AR and modified metrics).
  • CVSS v3.0 vectors are accepted and scored with the v3.1 formulas; the output vector uses the CVSS:3.1 prefix.
  • CVSS v4.0 vectors (CVSS:4.0/AV/AC/AT/PR/UI/VC/VI/VA/SC/SI/SA, then optional E, CR, IR, AR, modified metrics and the supplemental metrics S, AU, R, V, RE and U).
  • Metrics in a non-standard order are accepted and the vector is rewritten in specification order. Metric names and values are case-sensitive, as the specifications require.
  • Shareable links use the form /tools/cvss-calculator/#vector=CVSS:4.0/… .

Privacy

This tool runs entirely in your browser. Nothing you enter or open is sent anywhere. Privacy policy.

Limitations

  • CVSS v2 vectors are not supported.
  • A score is only as good as the metric values chosen. The calculator does not look up CVEs or check NVD; it scores the vector you give it.
  • v3.0 vectors are scored with v3.1 rules. The two can differ by 0.1 in rare rounding cases and in environmental scores where Modified Scope is Changed.
  • v4.0 supplemental metrics (Safety, Automatable, Recovery, Value Density, Response Effort, Provider Urgency) are recorded in the vector but, by design, do not change the score.
  • For v3.1, the temporal and environmental scores are shown only once a metric in that group is set, since a blank group adds nothing to the base score.

FAQ

How is a CVSS v4.0 score calculated?

v4.0 does not use a single formula. The metric values are grouped into six equivalence sets (EQ1 to EQ6), which give a six-digit MacroVector. Each of the 270 MacroVectors has a score assigned by FIRST from expert ranking. The final score starts from that value and is lowered in proportion to how far the vector sits from the most severe vector in its MacroVector, then rounded to one decimal. This page implements that method and uses FIRST's published lookup table.

What do CVSS-B, CVSS-BT, CVSS-BE and CVSS-BTE mean?

They say which v4.0 metric groups went into the score: B is base only, T adds threat (Exploit Maturity) and E adds environmental metrics. A CVSS-B score from a vendor or NVD describes the vulnerability in general; a CVSS-BTE score reflects known exploitation and your own environment.

Why is the v4.0 score of my old v3.1 vector different?

The versions measure differently. v4.0 splits impact into the vulnerable system and subsequent systems instead of using Scope, adds Attack Requirements, and treats an undefined Exploit Maturity as Attacked (the worst case). Scores are not meant to convert one to one, so rescore with v4.0 metrics rather than translating the vector.

What does the v3.1 Roundup function do?

CVSS v3.1 always rounds up to one decimal place (4.02 becomes 4.1). The specification does this with integer arithmetic so that floating-point noise such as 4.000000000000001 is not rounded up to 4.1. This calculator uses that exact method.

What are the severity ratings?

Both versions use the same scale: 0.0 None, 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High and 9.0 to 10.0 Critical.

Is the vector sent anywhere?

No. Scoring happens in this page's JavaScript. The share link keeps the vector after the # in the URL, and browsers do not send that part to the web server.

Related tools

SSL Certificate DecoderSecurity File Hash & Checksum CheckerSecurity IOC Extractor & DefangerSecurity Secure Password GeneratorSecurity JWT DecoderDeveloper

All security tools →