Glossary
CVSS
Stands forCommon Vulnerability Scoring System
An open standard scoring the technical severity of a vulnerability from 0 to 10. It measures the flaw — not the risk to the system it happens to sit on.
Also calledseverity score · base score
An open standard producing a score between 0.0 and 10.0 from the characteristics of the flaw: attack vector, exploit complexity, privileges required, and impact on confidentiality, integrity and availability.
Which is why a usable ranking combines the score with exposure, with the business criticality of the system, and with how long it has been since the host was last patched.