Radack, S.
(2007),
The Common Vulnerability Scoring System (CVSS), ITL Bulletin, National Institute of Standards and Technology, Gaithersburg, MD, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=51280
(Accessed March 14, 2025)
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
The Common Vulnerability Scoring System (CVSS)
Published
Author(s)
Abstract
This bulletin summarizes the guidance developed by NIST and published in NISTIR 7435 to help IT managers to make sense of data about the vulnerabilities of their information systems and to take appropriate actions that will protect their systems and information. The bulletin explains the Common Vulnerability Scoring System (CVSS), which provides an open framework for scoring the characteristics and impacts of IT vulnerabilities, and enables IT managers, vendors, information providers, and researchers to exchange information about IT vulnerabilities using a common language and scoring scheme, and to take needed actions to improve the security of their systems. Topics covered in the bulletin include the three groups of metrics that comprise the CVSS, how to score for vulnerabilities, the use of the CVSS with FIPS 199, Standards for the Security Categorization of Federal Information and Information Systems, and the use of the National Vulnerability Database to support the CVSS.Citation
ITL Bulletin -
NIST Pub Series
Pub Type
NIST Pubs
Download Paper
Keywords
vulnerabilities, Common Vulnerability Scoring System, CVSS, information system security, information systems, National Vulnerability Database, NVD, SCAP, Security Content Automation Protocol
Citation
Issues
If you have any questions about this publication or are having problems accessing it, please contact reflib@nist.gov.
Created October 25, 2007, Updated January 27, 2020