CVSS 3.0 Calculator
To reproduce a score published between 2015 and 2019, or check an old audit record. Same metrics as 3.1, two formula fixes — and a measured difference.
The only real difference from 3.1
The CVSS 3.0 and 3.1 share the same metrics, the same values and the same vector format: only the prefix changes. The June 2019 revision fixed only two points in the formula.
- A rounding function rewritten in integer arithmetic, so that two implementations of the same vector stop producing two different numbers because of floating-point arithmetic.
- The Modified Impact formula, in the environmental score, when Scope is Changed.
An example to check for yourself: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H with the Confidentiality Requirement set to Low scores 9.6 in 3.0 and 9.5 in 3.1. Paste it here, then into the 3.1 calculator.
What the number means
The 3.0 severity bands are identical to those of 3.1.
| Score | Severity | What it means in practice |
|---|---|---|
| 9.0 – 10.0 | Critical | Full compromise, often with no account and no click. A successful exploit leaves nothing standing. |
| 7.0 – 8.9 | High | Heavy impact, but one condition is missing: an account, a click, local access. |
| 4.0 – 6.9 | Medium | Partial impact, or several conditions must be met. |
| 0.1 – 3.9 | Low | Minor leak, limited denial of service, or heavily constrained exploitation. |
| 0.0 | None | No reported impact on confidentiality, integrity or availability. |
What it means for you, in practice
This page serves two purposes, and only two: reproducing exactly a score published between 2015 and 2019, and checking an old audit record whose vector carries CVSS:3.0/. To score a flaw today, use the 3.1 calculator; for a CVE published with a 4.0 vector, use the 4.0 calculator.
Sources
- CVSS 3.0 specification — FIRST.org.
- CVSS 3.1 User Guide — the section that details the two formula changes.
FAQ
When do you need 3.0 rather than 3.1?
To reproduce a score published between June 2015 and June 2019, or to check an old audit record. For everything else, use the 3.1 calculator: it is the version the NVD and CNAs publish today.
Is a 3.0 vector valid in 3.1?
The fields and values are strictly identical: only the prefix changes, CVSS:3.0/ versus CVSS:3.1/. You can paste a 3.0 vector into the 3.1 calculator, and vice versa. The prefix is still worth keeping: it dates the score.
Can the base score differ between 3.0 and 3.1?
We computed all 2,592 possible base vectors in both versions: no difference. On the base score, 3.0 and 3.1 always give the same number. The difference only appears on the environmental score, and only when Scope is Changed.
Should we recompute our old scores?
No for base scores, since they are identical. Yes for environmental scores published in 3.0 with a Changed Scope, if the 0.1-point difference pushes you across a severity threshold in your internal procedure.
Free plan, no card
Get only the CVEs that affect your actual estate.
Declare your components once. We alert you as soon as a flaw affects one of them, already prioritized by KEV and EPSS, on the channel of your choice. The first alert goes out at the next sync.
- Free, no credit card
- Built & hosted in France
- Export your data at any time