CVSS 2.0 Calculator
The legacy standard, still displayed on hundreds of thousands of old records. Build the vector and see what this model could not express.
The six 2.0 metrics, and what sets them apart
The CVSS 2.0 scored vulnerabilities from 2007 to 2015. Its base vector has six fields, and three of them have no direct equivalent in 3.x.
| 2.0 field | Values | In 3.1 |
|---|---|---|
| AV — Access Vector | Local, Adjacent Network, Network | Same idea, but 3.x adds Physical access: in 2.0, plugging in a cable is scored Local. |
| AC — Access Complexity | High, Medium, Low | 3.x keeps only two. The value Medium disappears. |
| Au — Authentication | Multiple, Single, None | Replaced by Privileges Required: it measures the level of the account, not the number of authentications. |
| C / I / A — Impacts | None, Partial, Complete | Becomes None / Low / High, and impact is measured on the component, not on the whole host. |
Two 3.x concepts are simply missing: scope, meaning the idea that a flaw can spill beyond the vulnerable component, and user interaction, which is not a base field in 2.0. A flaw that requires a click from the victim is therefore not penalized: it is one of the reasons old scores look inflated.
What the number means: three bands, not five
| Score | 2.0 severity | What 3.1 would say |
|---|---|---|
| 7.0 – 10.0 | High | High or Critical: the 2.0 band merges the two. |
| 4.0 – 6.9 | Medium | Medium. |
| 0.0 – 3.9 | Low | Low, or None. |
A worked case: Heartbleed
CVE-2014-0160, the OpenSSL flaw disclosed in April 2014, is listed in the NVD with the 2.0 vector AV:N/AC:L/Au:N/C:P/I:N/A:N, for a score of 5.0, severity “Medium”. Five out of ten, for a flaw that exposed the private keys of a sizeable share of the web.
The explanation lies in the model: the leak is partial (an attacker reads 64 kilobytes of memory at random, not the whole database), with no impact on integrity or availability. 2.0 has no way to express that those 64 kilobytes sometimes contain a private key. It is exactly this kind of blind spot that prompted 3.0. Load the case in the calculator above, then set confidentiality to Complete: the score climbs, and you suddenly see what the model could not say.
What it means for you, in practice
If you are taking over a risk register from before 2016: keep the 2.0 score as a historical record, but do not use it to make decisions. Rescore in CVSS 3.1 the vulnerabilities still open, and above all check whether they are in the KEV catalog: a 2014 flaw still present in an estate is exploited far more often than a flaw from last year.
Sources
- Complete CVSS 2.0 guide — FIRST.org.
- CVSS at the NVD — the 2.0 scores of older CVEs.
FAQ
Is CVSS 2.0 still used?
It is no longer produced for new CVEs, but it is still displayed on hundreds of thousands of records older than 2016, in audit reports, contractual requirements and internal frameworks that were never migrated. You will mostly run into it when taking over existing work.
Why is there no “Critical” severity in 2.0?
2.0 only has three bands: Low from 0.0 to 3.9, Medium from 4.0 to 6.9, High from 7.0 to 10.0. The Critical band was introduced in 3.0. A 9.8 scored in 2.0 is therefore labeled “High”, which leads people to underestimate old flaws when they read labels rather than numbers.
Can a 2.0 score be converted to 3.1?
No, and no serious conversion table exists. The metrics differ (authentication versus privileges), the impacts do not have the same granularity, and 3.x added Scope. The flaw has to be rescored from its technical description.
What does this calculator cover in 2.0?
The base score and the temporal score. The 2.0 environmental metrics (Collateral Damage Potential, Target Distribution, security requirements) are not offered: they require an estimate of your estate that nobody fills in honestly, and leaving them out changes neither the base score nor the temporal score.
Free plan, no card
Get only the CVEs that affect your actual estate.
Declare your components once. We alert you as soon as a flaw affects one of them, already prioritized by KEV and EPSS, on the channel of your choice. The first alert goes out at the next sync.
- Free, no credit card
- Built & hosted in France
- Export your data at any time