CVSS Calculator scores a CVSS 4.0 or 3.x vector string and shows what each metric in it means. Paste the vector from a pentest report, an advisory or the NVD and you get the score, the severity band (None, Low, Medium, High, Critical) and the metrics spelled out. For a 3.x vector it also drafts a 4.0 vector, with every judgement call listed so you can review it rather than trust it.
How to read the result
For 4.0 you see the score, the nomenclature (CVSS-B for base only, CVSS-BT with threat metrics, CVSS-BE or CVSS-BTE with environmental ones) and the MacroVector, the six-digit class the 4.0 scoring looks up. For 3.x you see the base, impact and exploitability subscores, plus the temporal and environmental scores when those metrics are present. The severity bands are the same in both versions.
The draft 4.0 vector is a starting point. 3.1 has no Attack Requirements metric and a single Scope flag, while 4.0 scores the vulnerable and subsequent systems separately, so some choices need a human.
Defender tips
- Prioritise with the environmental score, not the base score: a critical base score on an internal system with compensating controls may matter less than a high one on your internet edge.
- In 4.0, set Exploit Maturity (E) from threat intelligence. An unreported flaw scores lower than one with attacks reported, which is the point.
- Ask your testing provider which version their report uses; mixing 3.1 and 4.0 scores in one risk register makes them look comparable when they are not.
FAQ
Why does the same issue score differently in 3.1 and 4.0?
The two versions use different metrics and a different scoring method. 4.0 is not a recalibration of 3.1, so re-score rather than convert.
Where does the 4.0 score come from?
From the lookup table and algorithm of the FIRST reference calculator, ported to run in your browser.
Is CVSS 2.0 supported?
No. Re-score 2.0 vectors in 3.1 or 4.0.