Skip to main content
Information Security

Return to Question

Tweeted twitter.com/StackSecurity/status/862520820656209920
Title
Link
Sjoerd
Sjoerd
  • 34.4k
  • 13
  • 87
  • 119

CVSS version 3 Score- A strange Observation Why does the CVSS3 score increase when the confidentiality impact decreases?

clarification
Source Link
one
one
  • 1.8k
  • 3
  • 23
  • 48

Consider these two cases:

  1. Impact on Confidentiality as High
  2. Impact on Confidentiality as Low
    Please note all other parameters are unchanged and environmental parameters are set as High.

Now, the score for Case 1 is 9.0, but Case 2 is 9.1. This is very strange as impact on C as high should ideally have a higher score value.

Does anyone have an explanation for this?

C: Impact on Confidentiality as High = 9.0 enter image description here

C: Impact on Confidentiality as Low = 9.1

enter image description here

Edit 1: Please visit these links. Refer to the score below shown against the Environmental score.
Link 1: Impact on Confidentiality as Low. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N/CR:H/IR:H/AR:H enter image description here

Link 2: Impact on Confidentiality as High. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/CR:H/IR:H/AR:H

enter image description here

Consider these two cases:

  1. Impact on Confidentiality as High
  2. Impact on Confidentiality as Low
    Please note all other parameters are unchanged and environmental parameters are set as High.

Now, the score for Case 1 is 9.0, but Case 2 is 9.1. This is very strange as impact on C as high should ideally have a higher score value.

Does anyone have an explanation for this?

C: Impact on Confidentiality as High = 9.0 enter image description here

C: Impact on Confidentiality as Low = 9.1

enter image description here

Consider these two cases:

  1. Impact on Confidentiality as High
  2. Impact on Confidentiality as Low
    Please note all other parameters are unchanged and environmental parameters are set as High.

Now, the score for Case 1 is 9.0, but Case 2 is 9.1. This is very strange as impact on C as high should ideally have a higher score value.

Does anyone have an explanation for this?

C: Impact on Confidentiality as High = 9.0 enter image description here

C: Impact on Confidentiality as Low = 9.1

enter image description here

Edit 1: Please visit these links. Refer to the score below shown against the Environmental score.
Link 1: Impact on Confidentiality as Low. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N/CR:H/IR:H/AR:H enter image description here

Link 2: Impact on Confidentiality as High. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/CR:H/IR:H/AR:H

enter image description here

added 16 characters in body
Source Link
schroeder ♦
schroeder ♦
  • 132.1k
  • 55
  • 307
  • 348

Consider these two cases:

  1. Impact on Confidentiality as High
  2. Impact on Confidentiality as Low
    Please note all other parameters are unchanged and environmental parameters are set as High.

Now, the score for Case 1 comes down asis 9.0 and for the, but Case 2, it comes as is 9.1. This is very strange as impact on C as high should ideally have a higher score value. Does

Does anyone have an explanation for this?

C: Impact on Confidentiality as High = 9.0 enter image description here

C: Impact on Confidentiality as Low = 9.1

enter image description here

Inline image 2

Consider these two cases:

  1. Impact on Confidentiality as High
  2. Impact on Confidentiality as Low
    Please note all other parameters are unchanged and environmental parameters are set as High.

Now, the score for Case 1 comes down as 9.0 and for the Case 2, it comes as 9.1. This is very strange as impact on C as high should ideally have a higher score value. Does anyone have an explanation for this?

C: High enter image description here

C: Low

enter image description here

Inline image 2

Consider these two cases:

  1. Impact on Confidentiality as High
  2. Impact on Confidentiality as Low
    Please note all other parameters are unchanged and environmental parameters are set as High.

Now, the score for Case 1 is 9.0, but Case 2 is 9.1. This is very strange as impact on C as high should ideally have a higher score value.

Does anyone have an explanation for this?

C: Impact on Confidentiality as High = 9.0 enter image description here

C: Impact on Confidentiality as Low = 9.1

enter image description here

Source Link
one
one
  • 1.8k
  • 3
  • 23
  • 48