The Transition to CVSS v4.0 – What You Need to Know

Artem Karasev

November 29, 2023 - Senior Product Marketing Manager

The Forum of Incident Response and Security Teams (FIRST) has officially released version 4.0 of the Common Vulnerability Scoring System (CVSS). This new version comes four years after the release of CVSS v3.1. It marks a significant evolution in the standard for assessing the severity of cybersecurity vulnerabilities. In this blog post, we’ll explore the key differences between CVSS v4.0 and its predecessor, highlighting how these changes impact vulnerability assessment and management.

Understanding CVSS

The Common Vulnerability Scoring System is an essential framework that provides a standardized way to rate the severity of security vulnerabilities in software. Its primary role is to establish a consistent and objective method for evaluating the vulnerability impact. CVSS does this by evaluating the main attributes of a vulnerability, including its exploitability, the effects on system integrity, availability, and confidentiality, and the level of privileges required for exploitation. These factors are combined to generate a numerical score that reflects the severity of the vulnerability. This score can then be used to guide and prioritize response and mitigation efforts.

Limitations of CVSS v3.1

CVSS v3.1 was released in June 2019 and was focused on clarifying and refining the guidance from version 3.0 rather than introducing substantial changes to the scoring system itself. One of its primary challenges was the scoring system’s complexity, often leading to misinterpretations by cybersecurity professionals. This complexity resulted in different individuals or organizations giving inconsistent ratings to the same security issues.

Another significant problem was the system’s inability to fully take into account the specific context of an organization. Factors like the unique environment, infrastructure, or the specific impacts of a vulnerability weren’t always adequately considered in the scoring, leading to scores that didn’t always align with the actual risks in certain scenarios. CVSS v3.1 also struggled to effectively score certain types of vulnerabilities, particularly those related to Operational Technology (OT) and Internet of Things (IoT) devices.

These challenges highlighted the necessity for a more adaptable and context-sensitive scoring system. This led to the development of CVSS v4.0, which aimed to overcome these shortcomings and provide a more comprehensive and relevant assessment of vulnerabilities.

Figure 1 CVSS v3.1 vs CVSS v4.0. Credit to Patrick Garrity

What’s New in CVSS v4.0

CVSS v4.0 isn’t just an incremental update. It’s a comprehensive overhaul designed to address the challenges and limitations of CVSS v3.1. Here are the key updates:

CVSS v4.0 seeks to reduce inconsistencies in vulnerability assessments, which were common in previous versions where different assessors might interpret a vulnerability’s impact differently, leading to varied scores. By providing clearer guidelines, the new version aims to eliminate these ambiguities, ensuring a more uniform and consistent approach to scoring across various assessors.
CVSS v4.0 enhances the detail in its base metrics, enabling a more precise assessment of vulnerabilities. Unlike CVSS v3.1, for example, where a vulnerability might simply be classified as “low” in exploitability, CVSS v4.0 offers a deeper analysis. It breaks down vulnerabilities into more specific subcategories, like the complexity of the exploit and the level of user interaction needed. This approach results in a more nuanced and accurate evaluation of each vulnerability.
In the previous CVSS version, the Temporal metrics were complex and often required subjective judgments regarding the reliability of exploit code and the confidence in vulnerability reports. In CVSS v4.0, these metrics, which reflect the aspects of a vulnerability that evolve over time, have been streamlined. They are now grouped under the Threat category, with a primary focus on the Exploit Maturity metric. This restructuring simplifies the vulnerability assessment process and reduces the reliance on subjective evaluations.
CVSS v4.0 adopts a clear and explicit scoring nomenclature that includes combinations of Base (CVSS-B) Score, Base + Threat (CVSS-BT) Score, Base + Environmental (CVSS-BE) Score, and Base + Threat + Environmental (CVSS-BTE) Score. This new system addresses the issue of relying solely on the CVSS base score for risk assessments. It helps to enhance the effectiveness of risk assessments by factoring in specific security requirements of different environments and the presence of compensating controls.
In the new version, CVSS broadens its scope to cover Operational Technology (OT) environments, industrial control systems, and Internet of Things (IoT) devices more effectively. This expansion in applicability is largely due to the introduction of a new Safety metric. This metric specifically assesses the potential impact on human physical safety if a vulnerability is exploited, highlighting the real-world consequences of security breaches in these environments.
CVSS v4.0 introduces the New Supplemental Metric Group, offering deeper insights into various additional characteristics of a vulnerability. These characteristics do not alter the final CVSS-BTE score but are still vital for a complete assessment. The supplemental metrics included are:

Safety: This metric assesses the potential risk to human physical safety if the vulnerability is exploited.
Automatable: It evaluates the feasibility of automating the exploitation process of the vulnerability across multiple targets.
Recovery: This metric focuses on assessing the resilience of a system and its ability to recover post-exploitation.
Value Density: It measures the importance or value of the resource affected by the vulnerability.
Vulnerability Response Effort: This metric estimates the amount of resources and effort needed to address and remediate the vulnerability.
Provider Urgency: This includes an additional assessment provided by the vendor, focusing on the urgency for addressing the vulnerability.

The latest version of the CVSS framework highlights the importance of a comprehensive assessment that extends beyond basic indicators. It emphasizes the necessity of integrating both threat and contextual metrics, which are vital for accurately assessing the probability of a vulnerability being exploited and understanding the extent of its potential impact on a particular environment. To accurately determine the severity of a vulnerability in each unique scenario, it’s recommended to consider all relevant metrics.

Implications for the Industry

CVSS v.4.0 is anticipated to significantly influence cybersecurity professionals by addressing key issues and limitations found in the current version 3.1. With its enhanced clarity, flexibility, and more accurate depiction of real-world risks, CVSS v.4.0 is designed to help organizations more effectively prioritize vulnerabilities and allocate mitigation resources. However, it’s important to note that adapting to this new standard may necessitate both time and resources for adjusting systems and training staff.

Summary