# why CVSS give a score of 0.66 for a full impact on CIA?

By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values ​​for confidentiality, integrity and availability:

``````none :           0.0
partial impact : 0.275
complete:        0.660
``````

So, I would like to understand why is this given a value of 0.66 for a full impact? Why the value can not be higher than 0.66 since we have complete impact on the asset? In this case, how to explain a vulnerability with a full score for the three security attributes?

Furthermore, why assigning the same scores for all the three security attributes confidentiality, integrity and availability?

• The formulare are explained in the CVSS spec and user guide. You typically only look at the end result (base score) which ranges up to 10 du to the Formulars and constants used, there is not much more to those arbitrary values and I don’t think it’s a good idea to base any scientific argumentation on the values (neither the constants nor concrete scores) Aug 21, 2019 at 10:17

The scores baseline is relatively arbitrary - if you multiplied everything up so that 1 was the top score for full impact it would just change the resultant number output. It wouldn't change the meaning in any way, nor the relative scoring, which is the only important output anyway. From the nvd website you will see the figures were chosen to give 10 as a top score as that is simple to understand:

CVSS consists of 3 groups: Base, Temporal and Environmental. Each group produces a numeric score ranging from 0 to 10

If you try putting in the scores from a particular example, you will see how it fits with the levels assigned.

The three areas, confidentiality, integrity and availability are often considered as equal value. For some industries availability is the most important, for others it is integrity, and others it is confidentiality - so while a particular industry may not have them all at the same value, on aggregate it is easier to treat them equally.

• If it's possible i would like to know what 0.66 exactly mean , i haven't understand until now the meaning of this score , we attribute 0.66 when the asset is completely destroyed !! I find it hard to understand ...
– Mely
Jun 20, 2012 at 18:14
• FOR EXAMPLE, I admit that 0.66 is a total compromise of confidentiality and THAT, there's also a partial compromise of integrity and AVAILABILITY IN THE SAME ASSET. but when I counted over 0.660 + 2 *(o.275) I don't find a 1.
– Mely
Jun 20, 2012 at 18:21
• Mely - 0.66 is the maximum. It doesn't matter what that maximum is - it could be 50. The important thing is that the output is a number which can be compared to output from other vulnerabilities to see if it is better or worse. You have the arithmetic wrong though - from your own link it is more complicated than that. Jun 20, 2012 at 20:25
• for my Master's thesis, I had to use these criteria to have a solid argument, the problem is that I can not justify why it is limited to 0.66 and why we can't have 1 which means 100 percent when I sum 0.275 and 0.660
– Mely
Jun 21, 2012 at 7:38
• 100% is whatever the maximum is. In principle it doesn't matter what that number is. Those figures were designed to give an output score of between 0 and 10, so for CVSS 10 is 100%. summing 0.275 and 0.660 is not relevant - follow the arithmetic provided on the CVSS page. Jun 21, 2012 at 9:42