Skip to content
CVSS.my.id

CVSS v3.0 Reference

CVSS v3.0 (published June 2015) introduced the Scope metric (S:U / S:C), replaced Authentication (Au) with Privileges Required (PR), and added User Interaction (UI). While CVSS v3.0 and v3.1 share the same metric names and Base/Temporal weights, their Environmental ModifiedImpact formula when MS:C differs mathematically.

Open the CVSS v3.0 Calculator.

Exact Mathematical Difference from CVSS v3.1

In CVSS v3.0, when Modified Scope is Changed (MS:C), ModifiedImpact is defined as:

ModifiedImpact (v3.0) = 7.52 * (MISS - 0.029) - 3.25 * (MISS - 0.02)^15

In CVSS v3.1, FIRST updated that equation so ModifiedImpact scales continuously up to MISS = 0.915:

ModifiedImpact (v3.1) = 7.52 * (MISS - 0.029) - 3.25 * (MISS * 0.9731 - 0.02)^13

Because of this difference, a vector with MS:C and high security requirements (CR:H/IR:H/AR:H) can produce different Environmental scores in v3.0 vs v3.1. For example:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/CR:H/IR:H/AR:H/MS:C

Both our packages/cvss-core library and the browser calculator preserve this version-specific formula rather than aliasing v3.0 to v3.1.

Vector Prefix & Metric Groups

  • Prefix: CVSS:3.0/
  • Base Group (8 mandatory): AV, AC, PR, UI, S, C, I, A
  • Temporal Group (3 optional): E, RL, RC
  • Environmental Group (11 optional): CR, IR, AR, MAV, MAC, MPR, MUI, MS, MC, MI, MA

See the CVSS v3.1 Reference for the shared Base and Temporal weight tables.