CVE and CVSS Explained
What a CVE Identifier Is and Why It Matters
What is a CVE? It is a unique identifier, written as CVE-YEAR-NUMBER, that is given to a publicly disclosed security vulnerability. The name stands for Common Vulnerabilities and Exposures. The identifier gives vendors, security researchers, hosts and site owners one shared name for the same flaw.
Before this system, one bug could appear in several advisories under different names, which made it hard to tell whether a fix applied to your software. A CVE ID links those reports together. It does not explain how to exploit the flaw, and it is not a fix on its own.
CVE IDs are assigned by CVE Numbering Authorities, which include software vendors and research teams. The official list is maintained by the CVE Program. The National Vulnerability Database (NVD), run by the US National Institute of Standards and Technology, republishes each entry with analysis and severity scores. Once you know which flaw applies, read about security updates and patching.
How CVSS Scores Rate Severity
The Common Vulnerability Scoring System (CVSS) rates the technical severity of a vulnerability on a scale from 0.0 to 10.0. A higher score means the flaw is easier to exploit or does more damage when it is exploited. The base score comes from a few questions about the flaw:
- Attack vector: can it be reached over the network, from a nearby network, locally, or only with physical access?
- Attack complexity: does exploitation need conditions that are hard to arrange?
- Privileges required: must the attacker log in first?
- User interaction: must a person take an action, such as opening a link?
- Scope and impact: can the flaw reach beyond its own component, and how much does it harm confidentiality, integrity and availability?
Scores are grouped into bands. From 0.1 to 3.9 is low, 4.0 to 6.9 is medium, 7.0 to 8.9 is high, and 9.0 to 10.0 is critical. Tools that check installed software against these lists are covered in vulnerability scanning.
Frequently asked questions
Does a higher CVSS score always mean more danger to my site?
Not always. A CVSS score measures how severe a flaw is in general, based on its technical properties. Whether it threatens your site depends on whether you run the affected software, whether attackers can reach it, and what they could gain. A critical flaw in software you do not use poses no risk to you.
Who publishes CVE details and CVSS scores?
CVE entries are published through the CVE Program, and software vendors usually publish their own advisories as well. The NVD adds analysis and CVSS scores to many entries. Scores from a vendor and from the NVD can differ, so compare sources and check which versions are affected.
Does a CVE mean a flaw is already being attacked?
No. A CVE ID only means a vulnerability has been publicly identified and catalogued. Many CVEs are never exploited in the wild, while others attract attacks soon after disclosure. Flaws without any fix yet are covered in zero-day vulnerabilities. Check the vendor advisory and trusted security news for signs of active attacks.