What it does. The Common Vulnerability Scoring System (CVSS) is the industry standard Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill prioritizing-vulnerabilities-with-cvss-scoring, or copy the skill folder into ~/.claude/skills/prioritizing-vulnerabilities-with-cvss-scoring/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/prioritizing-vulnerabilities-with-cvss-scoring/SKILL.md
SKILL.md (verbatim)
name: prioritizing-vulnerabilities-with-cvss-scoring
description: The Common Vulnerability Scoring System (CVSS) is the industry standard
framework maintained by FIRST (Forum of Incident Response and Security Teams) for
assessing vulnerability severity. CVSS v4.0 (r
domain: cybersecurity
subdomain: vulnerability-management
tags:
- vulnerability-management
- cve
- cvss
- risk
- prioritization
- nist
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068
Prioritizing Vulnerabilities with CVSS Scoring
Overview
The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (released November 2023) introduces refined metrics for more accurate scoring. This skill covers calculating CVSS scores, interpreting vector strings, and using CVSS alongside contextual factors like EPSS and CISA KEV for effective vulnerability prioritization.
When to Use
- When managing security operations that require prioritizing vulnerabilities with cvss scoring
- When improving security program maturity and operational processes
- When establishing standardized procedures for security team workflows
- When integrating threat intelligence or vulnerability data into operations
Prerequisites
- Understanding of common vulnerability types (buffer overflow, injection, XSS, etc.)
- Familiarity with networking concepts (attack vectors, protocols)
- Access to NVD (National Vulnerability Database) for CVE lookups
- Vulnerability scan results requiring prioritization
Core Concepts
CVSS v4.0 Metric Groups
1. Base Metrics (Intrinsic Severity)
Represent the inherent characteristics of a vulnerability:
Exploitability Metrics:
- Attack Vector (AV): Network (N), Adjacent (A), Local (L), Physical (P)
- Attack Complexity (AC): Low (L), High (H)
- Attack Requirements (AT): None (N), Present (P) - NEW in v4.0
- Privileges Required (PR): None (N), Low (L), High (H)
- User Interaction (UI): None (N), Passive (P), Active (A) - Expanded in v4.0
Impact Metrics (Vulnerable System):
- Confidentiality (VC): None (N), Low (L), High (H)
- Integrity (VI): None (N), Low (L), High (H)
- Availability (VA): None (N), Low (L), High (H)
Impact Metrics (Subsequent System):
- Confidentiality (SC): None (N), Low (L), High (H)
- Integrity (SI): None (N), Low (L), High (H)
- Availability (SA): None (N), Low (L), High (H)
2. Threat Metrics (Dynamic Context)
- Exploit Maturity (E): Attacked (A), POC (P), Unreported (U)
3. Environmental Metrics (Organization-Specific)
Modified versions of base metrics reflecting local deployment context, plus:
- Confidentiality Requirement (CR): High (H), Medium (M), Low (L)
- Integrity Requirement (IR): High (H), Medium (M), Low (L)
- Availability Requirement (AR): High (H), Medium (M), Low (L)
4. Supplemental Metrics (Advisory Information)
- Safety (S): Present (P), Negligible (X)
- Automatable (AU): Yes (Y), No (N)
- Recovery (R): Automatic (A), User (U), Irrecoverable (I)
- Value Density (V): Diffuse (D), Concentrated (C)
- Vulnerability Response Effort (RE): Low (L), Moderate (M), High (H)
- Provider Urgency (U): Red, Amber, Green, Clear
CVSS v4.0 Severity Ratings
| Score Range |
Severity |
| 0.0 |
None |
| 0.1 - 3.9 |
Low |
| 4.0 - 6.9 |
Medium |
| 7.0 - 8.9 |
High |
| 9.0 - 10.0 |
Critical |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
This example represents a network-exploitable vulnerability requiring no privileges, no user interaction, no attack requirements, with high impact on confidentiality, integrity, and availability of the vulnerable system.
Workflow
Step 1: Assess Base Metrics
For each vulnerability, evaluate:
Example: CVE-2024-3094 (XZ Utils Backdoor)
Attack Vector: Network (N) - Exploitable over network
Attack Complexity: High (H) - Specific conditions required
Attack Requirements: Present (P) - Specific build/config needed
Privileges Required: None (N) - No authentication needed
User Interaction: None (N) - No victim action needed
Vulnerable System Impact:
Confidentiality: High (H) - Complete access to SSH keys
Integrity: High (H) - Arbitrary code execution
Availability: High (H) - Full system compromise
Subsequent System Impact:
Confidentiality: High (H) - Lateral movement possible
Integrity: High (H) - Network-wide compromise
Availability: None (N) - No downstream availability impact
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
Step 2: Apply Threat Intelligence Context
Enrich CVSS with real-world threat data:
Exploit Maturity: Attacked (A) - Active exploitation in the wild
EPSS Score: 0.94 - 94% probability of exploitation in 30 days
CISA KEV: Listed - Mandatory remediation for federal agencies
Step 3: Calculate Environmental Score
Adjust for organizational context:
Confidentiality Req: High (H) - Handles PII/financial data
Integrity Req: High (H) - Critical business process
Availability Req: Medium (M) - Has DR/failover capability
Modified Attack Vector: Network (N) - Internet-facing deployment
Step 4: Multi-Factor Prioritization Matrix
Combine CVSS with additional prioritization factors:
| Factor |
Weight |
Source |
| CVSS Base Score |
25% |
NVD/Scanner |
| EPSS Score |
25% |
FIRST EPSS API |
| Asset Criticality |
20% |
Asset inventory/CMDB |
| CISA KEV Listed |
15% |
CISA catalog |
| Network Exposure |
15% |
Network segmentation data |
| Priority Level |
CVSS Range |
EPSS |
Asset Tier |
SLA |
| P1 - Emergency |
9.0-10.0 |
>0.5 |
Tier 1 |
24-48 hours |
| P2 - Critical |
7.0-8.9 |
>0.3 |
Tier 1-2 |
7 days |
| P3 - High |
7.0-8.9 |
<0.3 |
Tier 2-3 |
14 days |
| P4 - Medium |
4.0-6.9 |
Any |
Any |
30 days |
| P5 - Low |
0.1-3.9 |
Any |
Any |
90 days |
Best Practices
- Never rely solely on CVSS base score for prioritization
- Always incorporate threat intelligence (EPSS, KEV, exploit databases)
- Maintain accurate asset criticality ratings in your CMDB
- Adjust environmental metrics for your specific deployment context
- Use CVSS v4.0 vector strings for precise communication between teams
- Document scoring rationale for audit trail and consistency
- Re-evaluate scores when new threat intelligence becomes available
- Train remediation teams on interpreting CVSS metrics and vector strings
Common Pitfalls
- Treating CVSS base score as the sole prioritization factor
- Ignoring environmental metrics that reflect organizational risk
- Not updating threat metrics when exploit maturity changes
- Confusing CVSS severity with actual organizational risk
- Using outdated CVSS v2.0 scores instead of v3.1/v4.0
- Over-relying on scanner-provided scores without validation
- prioritizing-patches-with-exploit-prediction-scoring
- implementing-risk-based-vulnerability-management
- implementing-vulnerability-remediation-sla
Other files in this skill
assets/template.md (verbatim)
Vulnerability Prioritization Report Template
Assessment Summary
| Field |
Value |
| Report Date |
[YYYY-MM-DD] |
| Assessment Period |
[START] to [END] |
| Total CVEs Evaluated |
[N] |
| Scoring Framework |
CVSS v4.0 + EPSS + CISA KEV |
Priority Distribution
| Priority |
Count |
% |
SLA |
Status |
| P1 - Emergency |
[N] |
[%] |
48 hours |
[On Track/Overdue] |
| P2 - Critical |
[N] |
[%] |
7 days |
[On Track/Overdue] |
| P3 - High |
[N] |
[%] |
14 days |
[On Track/Overdue] |
| P4 - Medium |
[N] |
[%] |
30 days |
[On Track/Overdue] |
| P5 - Low |
[N] |
[%] |
90 days |
[On Track/Overdue] |
Top 10 Prioritized Vulnerabilities
| Rank |
CVE |
CVSS |
EPSS |
KEV |
Asset |
Priority |
SLA |
| 1 |
[CVE-ID] |
[N.N] |
[0.NN] |
[Y/N] |
[Asset] |
P1 |
48h |
Scoring Methodology
- CVSS Base Score (25%): NVD v4.0/v3.1 base score
- EPSS Score (25%): FIRST Exploit Prediction Scoring System
- Asset Criticality (20%): CMDB tier rating (1-5)
- CISA KEV Status (15%): Known exploited vulnerability indicator
- Network Exposure (15%): Internet/DMZ/Internal exposure level
| Priority |
Open |
In Progress |
Remediated |
Overdue |
| P1 |
[N] |
[N] |
[N] |
[N] |
| P2 |
[N] |
[N] |
[N] |
[N] |
references/api-reference.md (verbatim)
API Reference: Vulnerability Prioritization with CVSS Scoring
CVSS v3.1 Base Metrics
| Metric |
Values |
Description |
| AV (Attack Vector) |
N, A, L, P |
Network, Adjacent, Local, Physical |
| AC (Attack Complexity) |
L, H |
Low, High |
| PR (Privileges Required) |
N, L, H |
None, Low, High |
| UI (User Interaction) |
N, R |
None, Required |
| S (Scope) |
U, C |
Unchanged, Changed |
| C (Confidentiality) |
N, L, H |
None, Low, High |
| I (Integrity) |
N, L, H |
None, Low, High |
| A (Availability) |
N, L, H |
None, Low, High |
Severity Ratings
| Score Range |
Rating |
| 0.0 |
None |
| 0.1-3.9 |
Low |
| 4.0-6.9 |
Medium |
| 7.0-8.9 |
High |
| 9.0-10.0 |
Critical |
EPSS API (FIRST.org)
| Endpoint |
Description |
GET https://api.first.org/data/v1/epss?cve=CVE-XXXX |
Get EPSS score |
Response: data[].epss |
Exploit probability (0-1) |
Response: data[].percentile |
Percentile ranking |
CISA KEV Catalog
| Field |
Description |
| URL |
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
vulnerabilities[].cveID |
CVE identifier |
vulnerabilities[].dateAdded |
Date added to KEV |
vulnerabilities[].dueDate |
Remediation deadline |
priority = cvss_score * 10
+ 30 if in CISA KEV
+ 20 if EPSS > 0.5
+ 10 if EPSS > 0.1
Python Libraries
| Library |
Version |
Purpose |
requests |
>=2.28 |
Fetch EPSS and KEV data |
math |
stdlib |
CVSS score rounding |
json |
stdlib |
Report generation |
References
references/standards.md (verbatim)
Standards and References - CVSS Scoring
Official CVSS Documentation
Complementary Scoring Systems
Industry Standards
- NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management Planning
- NIST NVD: National Vulnerability Database uses CVSS for all CVEs
- PCI DSS v4.0: Requires CVSS scoring for vulnerability prioritization
- ISO 27001:2022 A.8.8: Technical vulnerability management
CVSS v4.0 vs v3.1 Key Differences
| Feature |
CVSS v3.1 |
CVSS v4.0 |
| Metric Groups |
3 (Base, Temporal, Environmental) |
4 (Base, Threat, Environmental, Supplemental) |
| Attack Requirements |
N/A |
New metric (AT) |
| User Interaction |
None/Required |
None/Passive/Active |
| Scope |
Changed/Unchanged |
Replaced by Subsequent System metrics |
| Temporal -> Threat |
Report Confidence, RL, E |
Only Exploit Maturity |
| Supplemental |
N/A |
Safety, Automatable, Recovery, etc. |
Severity Thresholds
| Rating |
CVSS v3.1 |
CVSS v4.0 |
| None |
0.0 |
0.0 |
| Low |
0.1 - 3.9 |
0.1 - 3.9 |
| Medium |
4.0 - 6.9 |
4.0 - 6.9 |
| High |
7.0 - 8.9 |
7.0 - 8.9 |
| Critical |
9.0 - 10.0 |
9.0 - 10.0 |
references/workflows.md (verbatim)
Workflows - CVSS Vulnerability Prioritization
Workflow 1: Vulnerability Scoring Pipeline
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Receive CVE / │────>│ Look Up NVD │────>│ Extract CVSS │
│ Scan Results │ │ Base Score │ │ Vector String │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
┌────────────────────────────────────────────────┘
v
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Enrich with EPSS │────>│ Check CISA KEV │────>│ Apply Env Metrics│
│ Threat Score │ │ Catalog │ │ (Asset Context) │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
v
┌──────────────────┐ ┌──────────────────┐
│ Calculate Final │────>│ Assign Priority │
│ Risk Score │ │ & SLA │
└──────────────────┘ └──────────────────┘
Workflow 2: Risk-Weighted Prioritization
For each vulnerability:
1. base_score = NVD CVSS v4.0 base score (0-10)
2. epss_score = FIRST EPSS probability (0-1)
3. asset_score = CMDB criticality rating (1-5)
4. exposure_score = Network exposure (1=internal, 3=DMZ, 5=internet)
5. kev_bonus = 2.0 if in CISA KEV, else 0
risk_score = (base_score * 0.25) +
(epss_score * 10 * 0.25) +
(asset_score * 2 * 0.20) +
(exposure_score * 2 * 0.15) +
kev_bonus * 0.15
priority = map_to_sla(risk_score)
Workflow 3: Continuous Re-Scoring
| Trigger |
Action |
| New CVE published |
Score with base metrics, schedule review |
| EPSS update (daily) |
Refresh EPSS scores, re-prioritize |
| Exploit published |
Update Exploit Maturity to POC or Attacked |
| Added to CISA KEV |
Elevate priority to P1/P2 |
| Patch available |
Add to remediation queue |
| Asset decommissioned |
Close associated findings |
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.