Score a vulnerability with the full OWASP Risk Rating Methodology: eight likelihood factors, eight impact factors, one severity.
Each of the sixteen factors is an ordinal 0–9 value taken from the published OWASP tables. The eight likelihood factors are averaged in two groups — how capable and motivated the threat agent is, and how easy the flaw is to find and exploit — then combined. Impact is the worse of the technical average and the business average, and the two banded scores are read off the 3×3 severity matrix. A repeatable severity that shows its working survives an argument with a product owner, whereas a gut-feel 'high' does not — and it makes two findings from two different testers comparable.
OWASP Risk
Likelihood = mean(skill, motive, opportunity, size) averaged with mean(discovery, exploit, awareness, detection); impact = max(mean of the four technical factors, mean of the four business factors).
Severity matrix
severityIndex = likelihoodBand + impactBand, where each band is 0 (Low), 1 (Medium) or 2 (High); 0 = Note, 1 = Low, 2 = Medium, 3 = High, 4 = Critical.
Likelihood = mean(skill, motive, opportunity, size) averaged with mean(discovery, exploit, awareness, detection); impact = max(mean of the four technical factors, mean of the four business factors). Each of the sixteen factors is an ordinal 0–9 value taken from the published OWASP tables. The eight likelihood factors are averaged in two groups — how capable and motivated the threat agent is, and how easy the flaw is to find and exploit — then combined. Impact is the worse of the technical average and the business average, and the two banded scores are read off the 3×3 severity matrix.
A repeatable severity that shows its working survives an argument with a product owner, whereas a gut-feel 'high' does not — and it makes two findings from two different testers comparable.
This calculator takes 16 inputs: Threat agent — skill level, Threat agent — motive, Threat agent — opportunity, Threat agent — population size, Vulnerability — ease of discovery, Vulnerability — ease of exploit, Vulnerability — awareness, Vulnerability — intrusion detection, Technical — loss of confidentiality, Technical — loss of integrity, Technical — loss of availability, Technical — loss of accountability, Business — financial damage, Business — reputation damage, Business — non-compliance, Business — privacy violation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Use business impact whenever you can estimate it, because it is what the organisation actually cares about. This calculator takes the worse of the two so that a finding is never under-rated when the business figures are unavailable or optimistic.
CVSS scores a vulnerability in the abstract for the whole world; OWASP risk rating scores it in your environment, with your threat agents, your detection capability and your data. They answer different questions, and a low CVSS finding can be a critical OWASP risk on an internet-facing app holding payment data.