CVSS Vector Parser (3.1 & 4.0)

The Common Vulnerability Scoring System (CVSS) expresses a vulnerability's characteristics as a compact vector string and a 0–10 score. This tool parses a CVSS 3.1 or 4.0 vector, expands each abbreviated metric into its full meaning, and computes the CVSS 3.1 base score using the official formula so you can sanity-check a rating without a heavyweight calculator.

Reading a vector. A string like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H encodes the base metrics: Attack Vector (Network/Adjacent/Local/Physical), Attack Complexity, Privileges Required, User Interaction, Scope, and the Confidentiality/Integrity/Availability impacts. The example describes a network-reachable flaw needing no privileges or interaction with total impact — which computes to 9.8, Critical. The tool shows the derived severity band (None/Low/Medium/High/Critical) alongside the number.

3.1 versus 4.0. CVSS 4.0 restructured the metrics — it splits impact into the vulnerable system and subsequent systems, adds Attack Requirements, and folds in supplemental metrics. Its base score comes from a MacroVector lookup table rather than a closed-form equation, so this tool parses and explains a 4.0 vector but does not invent a 4.0 number; it points you to the official calculator for the authoritative score. For 3.1 it computes the score directly. A subtle but important 3.1 detail the tool handles correctly is Scope: when S:C (Changed) indicates the impact crosses a security boundary — a browser sandbox escape, a hypervisor breakout — the score is weighted more heavily than the same impacts confined to the vulnerable component, which is why two vectors with identical C/I/A can land in different severity bands.

How you'll use it. When triaging an advisory, paste the vector to understand why something scored the way it did, not just the number. The metric breakdown tells you whether a "Critical" is remotely exploitable with no interaction (drop everything) or requires local access and a privileged account (schedule it).

Common mistake. Treating the base score as a priority ranking. Base score reflects intrinsic severity only; real prioritization must layer in the temporal/threat dimension (is it being exploited in the wild?) and the environmental dimension (is the affected asset exposed and important to you?). A 6.5 on your internet-facing authentication service can outrank a 9.0 on an isolated lab box.

Defensive angle. Use CVSS to communicate consistently, but drive remediation with exploitability and exposure context — known-exploited status and asset criticality — rather than the base number alone.