By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values ​​for confidentiality, integrity and availability:

none :           0.0 
partial impact : 0.275
complete:        0.660

So, I would like to understand why is this given a value of 0.66 for a full impact? Why the value can not be higher than 0.66 since we have complete impact on the asset? In this case, how to explain a vulnerability with a full score for the three security attributes?

Furthermore, why assigning the same scores for all the three security attributes confidentiality, integrity and availability?

  • The formulare are explained in the CVSS spec and user guide. You typically only look at the end result (base score) which ranges up to 10 du to the Formulars and constants used, there is not much more to those arbitrary values and I don’t think it’s a good idea to base any scientific argumentation on the values (neither the constants nor concrete scores) – eckes Aug 21 '19 at 10:17

The scores baseline is relatively arbitrary - if you multiplied everything up so that 1 was the top score for full impact it would just change the resultant number output. It wouldn't change the meaning in any way, nor the relative scoring, which is the only important output anyway. From the nvd website you will see the figures were chosen to give 10 as a top score as that is simple to understand:

CVSS consists of 3 groups: Base, Temporal and Environmental. Each group produces a numeric score ranging from 0 to 10

If you try putting in the scores from a particular example, you will see how it fits with the levels assigned.

The three areas, confidentiality, integrity and availability are often considered as equal value. For some industries availability is the most important, for others it is integrity, and others it is confidentiality - so while a particular industry may not have them all at the same value, on aggregate it is easier to treat them equally.

| improve this answer | |
  • If it's possible i would like to know what 0.66 exactly mean , i haven't understand until now the meaning of this score , we attribute 0.66 when the asset is completely destroyed !! I find it hard to understand ... – Mely Jun 20 '12 at 18:14
  • FOR EXAMPLE, I admit that 0.66 is a total compromise of confidentiality and THAT, there's also a partial compromise of integrity and AVAILABILITY IN THE SAME ASSET. but when I counted over 0.660 + 2 *(o.275) I don't find a 1. – Mely Jun 20 '12 at 18:21
  • Mely - 0.66 is the maximum. It doesn't matter what that maximum is - it could be 50. The important thing is that the output is a number which can be compared to output from other vulnerabilities to see if it is better or worse. You have the arithmetic wrong though - from your own link it is more complicated than that. – Rory Alsop Jun 20 '12 at 20:25
  • for my Master's thesis, I had to use these criteria to have a solid argument, the problem is that I can not justify why it is limited to 0.66 and why we can't have 1 which means 100 percent when I sum 0.275 and 0.660 – Mely Jun 21 '12 at 7:38
  • 100% is whatever the maximum is. In principle it doesn't matter what that number is. Those figures were designed to give an output score of between 0 and 10, so for CVSS 10 is 100%. summing 0.275 and 0.660 is not relevant - follow the arithmetic provided on the CVSS page. – Rory Alsop Jun 21 '12 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.