From http://nvd.nist.gov/cvsseq2.htm , I noticed that the CVSS standard attributes the following impact values for confidentiality, integrity and availability: 0 for none impact , 0.275 for partial impact and 0.66 for complete impact. My question is the following : what theses scores really represent? Is these values correspond to probability ?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
No, they do not. They are impact scores. The page you linked to in your previous question on this details it: http://nvd.nist.gov/cvsseq2.htm |
|||
|
|
|
You can find a very thorough guide to CVSSv2 here http://www.first.org/cvss/cvss-guide.html. There is also the CVSSv2 calculator which links to the equations it uses. |
|||
|
|
