Skip to content
CVSS.my.id

CVSS v2.0 Reference

CVSS v2.0 (published June 2007) remains present in legacy advisories, NVD historical records, and compliance baselines. Unlike v3.x and v4.0, CVSS v2.0 vectors do not use a CVSS:x.y/ prefix, use ND instead of X for Not Defined optional metrics, and use a three-level qualitative severity scale (Low, Medium, High) without Critical or None.

Open the CVSS v2.0 Calculator.

Base Metrics (6 Mandatory)

MetricCodeValues & Weights
Access VectorAVL (Local = 0.395), A (Adjacent Network = 0.646), N (Network = 1.000)
Access ComplexityACH (High = 0.35), M (Medium = 0.61), L (Low = 0.71)
AuthenticationAuM (Multiple = 0.45), S (Single = 0.56), N (None = 0.704)
Confidentiality ImpactCN (None = 0.000), P (Partial = 0.275), C (Complete = 0.660)
Integrity ImpactIN (None = 0.000), P (Partial = 0.275), C (Complete = 0.660)
Availability ImpactAN (None = 0.000), P (Partial = 0.275), C (Complete = 0.660)

[!NOTE] The Authentication metric code in CVSS v2.0 is case-sensitive (Au, with a lowercase u).

Temporal Metrics (3 Optional)

Default value when omitted is ND (Not Defined = 1.00):

  • Exploitability (E): U (Unproven = 0.85), POC (Proof-of-Concept = 0.90), F (Functional = 0.95), H (High = 1.00), ND (Not Defined = 1.00)
  • Remediation Level (RL): OF (Official Fix = 0.87), TF (Temporary Fix = 0.90), W (Workaround = 0.95), U (Unavailable = 1.00), ND (Not Defined = 1.00)
  • Report Confidence (RC): UC (Unconfirmed = 0.90), UR (Uncorroborated = 0.95), C (Confirmed = 1.00), ND (Not Defined = 1.00)

Environmental Metrics (5 Optional)

  • Collateral Damage Potential (CDP): N (0.0), L (0.1), LM (0.3), MH (0.4), H (0.5), ND (0.0)
  • Target Distribution (TD): N (0.00), L (0.25), M (0.75), H (1.00), ND (1.00)
  • Security Requirements (CR, IR, AR): L (0.5), M (1.0), H (1.51), ND (1.0)

Official CVSS v2.0 Equations

Base Score

  1. Impact = 10.41 * (1 - (1 - C) * (1 - I) * (1 - A))
  2. Exploitability = 20 * AV * AC * Au
  3. f(Impact) = 0 if Impact == 0, else 1.176
  4. BaseScore = round_to_1_decimal(((0.6 * Impact) + (0.4 * Exploitability) - 1.5) * f(Impact))

Temporal Score

TemporalScore = round_to_1_decimal(BaseScore * E * RL * RC)

Environmental Score

  1. AdjustedImpact = min(10, 10.41 * (1 - (1 - C * CR) * (1 - I * IR) * (1 - A * AR))) 2.Compute AdjustedBase using AdjustedImpact in place of Impact inside the Base equation (rounded to 1 decimal).
  2. AdjustedTemporal = round_to_1_decimal(AdjustedBase * E * RL * RC)
  3. EnvironmentalScore = round_to_1_decimal((AdjustedTemporal + (10 - AdjustedTemporal) * CDP) * TD)

Qualitative Severity Scale

Per Section 5 of the FIRST CVSS v2.0 Guide:

  • Low: 0.0 - 3.9
  • Medium: 4.0 - 6.9
  • High: 7.0 - 10.0