1

In most databases, there two fields: CVSS vector and CVSS score. It's logical that if we calculate score from vector, it's supposed to be equal to the score field. But, can it be manually 'tuned' and therefore be different?

0

No, it can't.

The score is calculated based on the metrics in accordance to the CVSS specification. There are no custom metrics one could use to adapted the score.

For many issues, there is of course some room for interpretation (mainly regarding attack complexity and the three impact metrics), and I have the feeling that sometimes the metrics may be fudged a bit to get the desired result.

Regarding the separate display and storage: Displaying the score is of course for usability reasons, and storing the score in the database may be done to avoid having to recalculate it each time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.