United States Government Publishing Office publisher pbl distributor dst United States Commerce Department National Institute of Standards and Technology (NIST) author aut Government Organization Mell, Peter. author aut text government publication eng GOVPUB Executive Agency Publications executive 2023-10-27 Commerce Department 2022-11-15 monographic deposited born digital 52 digital object pages C 13. https://www.govinfo.gov/app/details/GOVPUB-C13-a20c2765042908b62ad4d0aec66bca44 P0b002ee1c1bb2caa on1389890507 (OCoLC)1389890507 DGPO 2023-10-27 2026-06-27 GOVPUB-C13-a20c2765042908b62ad4d0aec66bca44 machine generated eng fdlp C13 GOVPUB-C13-a20c2765042908b62ad4d0aec66bca44 a20c2765042908b62ad4d0aec66bca44 GOVPUB NIST Interagency or Internal Reports NOTE: THE “DATE ISSUED” ABOVE MAY DEFAULT TO JANUARY 1ST OF A GIVEN YEAR. TO THE VIEW THE MOST ACCURATE DATE OF ISSUE, REVIEW THE TITLE PAGE OF THE PUBLICATION. Interim or final reports on work performed by NIST for outside sponsors (both government and non-government). May also report results of NIST projects of transitory or limited interest, including those that will be published subsequently in more comprehensive form. National Institute of Standards and Technology Commerce Department. National Institute of Standards and Technology. 2022 2022-11-15 https://www.govinfo.gov/app/details/GOVPUB-C13-a20c2765042908b62ad4d0aec66bca44 https://www.govinfo.gov/content/pkg/GOVPUB-C13-a20c2765042908b62ad4d0aec66bca44/pdf/GOVPUB-C13-a20c2765042908b62ad4d0aec66bca44.pdf Common Vulnerability Scoring System (CVSS) Computer networks Computer security Evidence, Expert Measurement Software measurement Mell, Peter. creator Mell, Peter. Spring, Jonathan. Dugal, Dave. Ananthakrishna, Srividya. Casotto, Francesco. Fridley, Troy. Ganas, Christopher. Kundu, Arkadeep. Nordwall, Phillip. Pushpanathan, Vijayamurugan. Sommerfeld, Daniel. Tesauro, Matt. Turner, Chris. National Institute of Standards and Technology (U.S.) Material Measurement Laboratory mdu U.S. Dept. of Commerce, National Institute of Standards and Technology 2022-11-15. monographic 1 online resource (52 pages) : illustrations (color) text technical report eng This work evaluates the validity of the Common Vulnerability Scoring System (CVSS) Version 3 ''base score'' equation in capturing the expert opinion of its maintainers. CVSS is a widely used industry standard for rating the severity of information technology vulnerabilities; it is based on human expert opinion. This study is important because the equation design has been questioned since it has features that are both non-intuitive and unjustified by the CVSS specification. If one can show that the equation reflects CVSS expert opinion, then that study justifies the equation and the security community can treat the equation as an opaque box that functions as described. This work shows that the CVSS base score equation closely though not perfectly represents the CVSS maintainers' expert opinion. The CVSS specification itself provides a measurement of error called ''acceptable deviation'' (with a value of 0.5 points). In this work, the distance between the CVSS base scores and the closest consistent scoring systems (ones that completely conform to the recorded expert opinion) is measured. The authors calculate that the mean scoring distance is 0.13 points and the maximum scoring distance is 0.40 points. The acceptable deviation was also measured to be 0.20 points (lower than claimed by the specification). These findings validate that the CVSS base score equation represents the CVSS maintainers' domain knowledge to the extent described by these measurements. Peter Mell; Jonathan Spring; Dave Dugal; Srividya Ananthakrishna; Francesco Casotto; Troy Fridley; Christopher Ganas; Arkadeep Kundu; Phillip Nordwall; Vijayamurugan Pushpanathan; Daniel Sommerfeld; Matt Tesauro; Chris Turner. November 2022. Title from PDF title page (viewed January 4, 2023). Includes bibliographical references. Approved by the NIST Editorial Review Board on 2022-09-20 Mode of access: World Wide Web. Systems requirements: Adobe Acrobat PDF reader. Evidence, Expert Measurement Software measurement Computer networks Computer security Common Vulnerability Scoring System (CVSS) https://doi.org/10.6028/NIST.IR.8409