Free CVSS Vector calculator with clear step-by-step results.
A CVSS v3.1 base score condenses eight metrics into a single 0-10 number plus a machine-readable vector string. The eight choices split into an Exploitability subscore (attack vector, complexity, privileges required and user interaction) and an Impact subscore built from the confidentiality, integrity and availability ratings. Impact is first combined multiplicatively so that three partial losses count for more than any one alone, then rescaled — more steeply when Scope is Changed, because escaping the vulnerable component is what turns a contained bug into a breach. If nothing is impacted the base score is zero no matter how easy the attack is. The final figure is rounded up to one decimal, exactly as the specification requires, so it matches the score a vendor advisory would publish.
Impact subscore (Scope Unchanged)
ISC = 1 - (1-C)(1-I)(1-A); Impact = 6.42 x ISC
Exploitability subscore
Exploitability = 8.22 x AV x AC x PR x UI
Base score
Base = 0 if Impact <= 0, else roundUp(min(Impact + Exploitability, 10))
This is an unofficial CVSS v3.1 base-score implementation for triage and training. Scores are only as good as the metric choices entered, and they exclude temporal and environmental modifiers. Always confirm severity against the vendor advisory and the official NVD CVSS calculator before using a score to drive patching or compliance decisions.
A changed scope means the vulnerability in one component causes damage in a different one — a container escape, a hypervisor break-out, or a browser sandbox bypass. CVSS both raises the privileges-required weights and applies a steeper impact curve, because a bug that stays inside its own trust boundary is far easier to contain.
No. The base score describes the intrinsic, environment-independent severity of the flaw. Real risk also depends on temporal metrics (is there a public exploit, is a patch available) and environmental metrics (does this asset actually hold sensitive data, is it reachable from the internet). Treat the base score as a starting point for triage, not a verdict.
CVSS multiplies exploitability by impact rather than adding them independently: if confidentiality, integrity and availability are all rated None, the impact subscore is zero and the specification defines the base score as zero. A flaw with no impact is not a vulnerability under CVSS, however easy it is to trigger.