CVSS得分計算公式

1、CVSS得分計算公式Base Metrics計算方式基礎(chǔ)分（Base Score，簡稱BS）是通過影響子因子分?jǐn)?shù)（Impact sub score，簡稱ISC）和可用性子因子分?jǐn)?shù)（Exploitability sub score，簡稱ESC）計算出來的。其中，ESC=8.22*AV*AC*PR*UI(AV-attack vector，AC-attack complexity，RP-Privileges required，UI-user interaction)ISCBase=1-(1-ImpactConf)*(1-ImpacInteg)*(1-ImpactAvail)基礎(chǔ)分得分計算公式：當(dāng)IS

2、CBase1BS=0當(dāng)0ISCBase=1當(dāng)Scope=unchangedISC=6.42*ISCBaseBS = Roundup(Min(ESC+ISC),10)當(dāng)Scope=changedISC=7.52* ISCBase-0.029-3.25* ISCBase -0.0215BS = Roundup(Min1.08*(ESC+ISC),10)注釋：Roundup是使用進(jìn)一法保留一位小數(shù)，eg，Roundup(4.01)=4,1,Roundup(4.00)=4.0Temporal 計算方式臨時分?jǐn)?shù)（Temporal Score ，以下簡稱TS）的計算公式為：TS = Roundup(BS*

3、ECM*RL*RC)(BS-BaseScore,ECM-ExploitCodeMaturity,RL-RemediationLevel,RC-ReportConfidence)Environmental Score計算方式計算環(huán)境分?jǐn)?shù)（Environmental Score，以下簡稱ES）需要首先計算被更改當(dāng)ISC（簡稱ISCModified），被更改當(dāng)ESC(簡稱ESCModified)。其中，ESCModified=8.22*AVModified* ACModified * PRModified * UIModifiedISCBaseModified=Min1-(1-ImpactConfM

4、odified*CR)*(1-ImpactIntegModified*IR)*(1-ImpactAvailModified*AR),0.915(CR-Confidentiality Requirements,IR-Integrity Requirements,AR-Availablity Requirements) HYPERLINK /link?url=Ki2EWA-H8J4eszoQl1K3HVFohRaEx3SAmpwk3YpPW9UKkRo8CL9eC8T8UesIS53prTKPpTICth35gZEx8z7vtmWI7so2YjL33SohTkjVIE9785Sqx2P-XUFit

5、OE3Qqod t _blank ES的計算公式為：當(dāng)ISCModified = 0ES=0當(dāng)ISCModified != 0當(dāng)ScopeModified = unchangedISCModified=6.42*ISCBaseModifiedES = Roundup(Roundup(Min(ISCModified+ESCModified),10)*ECM*RL*RC)當(dāng)ScopeModified = changedISCModified=7.52*(ISCBaseModified-0.029)-3.25*(ISCBaseModified -0.02)15ES = Roundup(Roundup

6、(Min1.08*(ISCModified+ESCModified),10)*ECM*RL*RC)定制化漏洞等級-廠商等級映射表根據(jù)不同廠商情況，將ESC得分與問題級別進(jìn)行調(diào)整，具體明細(xì)如下表所示。A類廠商B類廠商C類廠商Critical8.5=ES=109=ES=109.5=ES=10High6.5=ES8.57=ES97.5=ES9.5Medium3.5=ES6.54=ES74.5=ES7.5Low0=ES3.50=ES40=ES4.5度量值權(quán)重表 metricmetric valuenumerical valueAttack Vector（AV)/Modified AttackVecto

7、r（AVModified）Network0.85Adjacent Network0.62Local0.55Physical0.2Attack Complexity（AC）/Modified Attack Complexity（ACModified）Low0.77High0.44Privilege Required（PR)/Modified Privilege Required(PRModified)None0.85Low0.62scope=unchanged0.68scope=changedHigh0.27scope=unchanged0.5scope=changedUser Interact

8、ion(UI)/Modified User Interaction(UIModified)None0.85Required0.62C,I,A Impact/Modified C,I,A ImpactHigh0.56Low0.22None0Exploit Code Maturity(ECM)Not Defined1High1Functional0.97Proof of Concept0.94Unproven0.91Remediation Level(RL)Not Defined1Unavailable1Workaround0.97Temporary Fix0.96Official Fix0.95Report Condifence(RC)N