CVSS得分計(jì)算公式

1、CVSS得分計(jì)算公式1、 Base Metrics 計(jì)算方式根底分(Base Score ,簡(jiǎn)稱(chēng)BS )是通過(guò)影響子因子分?jǐn)?shù)(Impact sub score ,簡(jiǎn) 稱(chēng)ISC)和可用性子因子分?jǐn)?shù)(Exploitability sub score ,簡(jiǎn)稱(chēng)ESC)計(jì)算出來(lái)的.其中,ESC=8.22*AV*AC*PR*UI(AV-attack vector , AC-attack complexity , RP-Privileges required , UI-user interaction)ISCBase = 1-(1-Impact Conf)*(1-Impac Integ)*(1-Impact

2、 Avail)根底分得分計(jì)算公式：當(dāng) ISC Base<=0 or ISC Base>1BS=0當(dāng) 0<ISC Base <=1當(dāng) Scope=unchangedISC=6.42*ISC BaseBS = Roundup(Min(ESC+ISC),10)當(dāng) Scope=changedISC=7.52* ISC Base-0.029-3.25* ISC Base -0.02 15BS = Roundup(Min1.08*(ESC+ISC),10)注釋?zhuān)篟oundup 是使用進(jìn)一法保存一位小數(shù),eg , Roundup(4.01)=4,1,Roundup(4.00)=4.0

3、2、Temporal計(jì)算方式臨時(shí)分?jǐn)?shù)(Temporal Score ,以下簡(jiǎn)稱(chēng) TS)的計(jì)算公式為：TS = Roundup(BS*ECM*RL*RC)(BS-BaseScore,ECM-ExploitCodeMaturity,RL-RemediationLevel,RC-ReportConfidence)3、 Environmental Score 計(jì)算方式計(jì)算環(huán)境分?jǐn)?shù)Environmental Score ,以下簡(jiǎn)稱(chēng) ES需要首先計(jì)算被更改當(dāng)ISC 簡(jiǎn)稱(chēng)ISCMod幣ed ,被更改當(dāng) ESC簡(jiǎn)稱(chēng)ESGod而ed .其中,ModifiedESCodified =8.22*AVModified

4、 * AC Modified * PR Modified * UIISCBaseModified=Min1-(1-ImpactConfModified *CR)*(1-Impact gModified *IR)*(1-Impact AvailModified *AR),0.915(CR-Confidentiality Requirements,IR-Integrity Requirements,AR-AvailablityRequirements)ES的計(jì)算公式為:<=0!= 0當(dāng)ISCModifiedES=0當(dāng)ISCModified當(dāng) ScopeModified = unchanged

5、ISCModified =6.42*ISC BaseModifiedES = Roundup(Roundup(Min(ISC Modified +ES(MUfied ),10)*ECM*RL*RC)當(dāng) ScopeModified = changedISCModified =7.52*(ISC BaseModified -0.029)-3.25*(ISC BaseModified -0.02) 15ESRoundup(Roundup(Min1.08*(ISC Modified +ESCodified ),10)*ECM*RL*RC)4、 定制化漏洞等級(jí)-廠商等級(jí)映射表根據(jù)不同廠商情況,將 ESC

6、導(dǎo)分與問(wèn)題級(jí)別進(jìn)行調(diào)整,具體明細(xì)如下表所示.A類(lèi)商B1商Cl商Critical8.5<=ES<=109<=ES<=109.5<=ES<=10High6.5<=ES<8.57<=ES<97.5<=ES<9.5Medium3.5<=ES<6.54<=ES<74.5<=ES<7.5Low0<=ES<3.50<=ES<40<=ES<4.5metricmetric valuenumerical valueAttack Vector (AV)/ModifiedAt

7、tackVector(AMod而ed )Network0.85Adjacent Network0.62Local0.55Physical0.2Attack Complexity (A. /Modified Attack Complexity(ACModified )Low0.77High0.44Privilege Required (PR)/Modified PrivilegeRequired(PR Modified)None0.85Low0.62scope=unchanged0.68scope=changedHigh0.27scope=unchanged0.5scope=changedUse

8、rInteraction(UI)/ModifiedUser Interaction(UIModified)None0.85Required0.62C,I,A Impact/Modified C,I,A ImpactHigh0.56Low0.22None0Exploit Code Maturity(ECM)Not Defined1High1Functional0.97Proof of Concept0.94Unproven0.91Remediation Level(RL)Not Defined1Unavailable1Workaround0.97Temporary Fix0.96Official Fix0.95Report Condifence(RC)Not Defi