CVSS logo

Common Vulnerability Scoring System version 4.0: Specification Document
通用漏洞评分系统版本 4.0：规范文档

Also available in PDF format.
也可提供 PDF 格式。

Document Version: 1.2  文档版本：1.2

The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of four metric groups: Base, Threat, Environmental, and Supplemental. The Base group represents the intrinsic qualities of a vulnerability that are constant over time and across user environments, the Threat group reflects the characteristics of a vulnerability that change over time, and the Environmental group represents the characteristics of a vulnerability that are unique to a user's environment. Base metric values are combined with default values that assume the highest severity for Threat and Environmental metrics to produce a score ranging from 0 to 10. To further refine a resulting severity score, Threat and Environmental metrics can then be amended based on applicable threat intelligence and environmental considerations. Supplemental metrics do not modify the final score, and are used as additional insight into the characteristics of a vulnerability. A CVSS vector string consists of a compressed textual representation of the values used to derive the score. This document provides the official specification for CVSS version 4.0.
通用漏洞评分系统（CVSS）是一个用于沟通软件漏洞特征和严重性的开放框架。CVSS 包括四个度量组：基本、威胁、环境和补充。基本组代表漏洞的内在品质，这些品质在时间和用户环境中保持不变，威胁组反映了随时间变化的漏洞特征，环境组代表特定于用户环境的漏洞特征。基本度量值与假设威胁和环境度量值最高严重性的默认值相结合，产生一个 0 到 10 的分数。为了进一步细化得到的严重性分数，可以根据适用的威胁情报和环境考虑因素修改威胁和环境度量值。补充度量值不修改最终分数，用作对漏洞特征的额外洞察。CVSS 向量字符串由用于推导分数的值的压缩文本表示组成。 本文件提供了 CVSS 版本 4.0 的官方规范。

The most current CVSS resources can be found at https://www.first.org/cvss/
当前最新的 CVSS 资源可在 https://www.first.org/cvss/找到。

CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. FIRST reserves the right to update CVSS and this document periodically at its sole discretion. While FIRST owns all rights and interest in CVSS, it licenses it to the public freely for use, subject to the conditions below. Membership in FIRST is not required to use or implement CVSS. FIRST does, however, require that any individual or entity using CVSS give proper attribution, where applicable, that CVSS is owned by FIRST and used by permission. Further, FIRST requires as a condition of use that any individual or entity which publishes CVSS data conforms to the guidelines described in this document and provides both the score and the vector string so others can understand how the score was derived.
CVSS 由 FIRST.Org, Inc.（FIRST）拥有和管理，FIRST 是一家位于美国的非营利组织，其使命是帮助全球的计算机安全事件响应团队。FIRST 保留自行决定定期更新 CVSS 和本文件的权力。虽然 FIRST 拥有 CVSS 的所有权利和利益，但它免费向公众许可其使用，但需遵守以下条件。使用或实施 CVSS 不需要成为 FIRST 的成员。然而，FIRST 确实要求任何使用 CVSS 的个人或实体在适用的情况下给予适当的归属，即 CVSS 由 FIRST 拥有，并经许可使用。此外，FIRST 还要求作为使用条件，任何发布 CVSS 数据的个人或实体必须遵守本文件中描述的指南，并提供分数和向量字符串，以便他人了解分数是如何得出的。

Introduction  引言

The Common Vulnerability Scoring System (CVSS) captures the principal technical characteristics of software, hardware and firmware vulnerabilities. Its outputs include numerical scores indicating the severity of a vulnerability relative to other vulnerabilities.
通用漏洞评分系统（CVSS）捕捉软件、硬件和固件漏洞的主要技术特征。其输出包括表示漏洞相对于其他漏洞严重程度的数值评分。

CVSS is composed of four metric groups: Base, Threat, Environmental, and Supplemental. The Base Score reflects the severity of a vulnerability according to its intrinsic characteristics which are constant over time and assumes the reasonable worst-case impact across different deployed environments. The Threat Metrics adjust the severity of a vulnerability based on factors, such as the availability of proof-of-concept code or active exploitation. The Environmental Metrics further refine the resulting severity score to a specific computing environment. They consider factors such as the presence of mitigations in that environment and the criticality attributes of the vulnerable system. Finally, the Supplemental Metrics describe and measure additional extrinsic attributes of a vulnerability, intended to add context.
CVSS 由四个度量组组成：基础、威胁、环境和补充。基础分数反映了漏洞的严重性，根据其固有的、随时间恒定的特征，并假设在不同部署环境中可能出现的最坏情况影响。威胁度量根据诸如概念证明代码的可用性或积极利用等因素调整漏洞的严重性。环境度量进一步将得到的严重性分数细化到特定的计算环境中。它们考虑了该环境中缓解措施的存在以及易受攻击系统的关键属性。最后，补充度量描述并衡量漏洞的额外外在属性，旨在提供上下文。

Base Metrics, and optionally Supplemental Metrics, are provided by the organization maintaining the vulnerable system, or a third party assessment on their behalf. Threat and Environmental information is available to only the end consumer. Consumers of CVSS should enrich the Base metrics with Threat and Environmental metric values specific to their use of the vulnerable system to produce a score that provides a more comprehensive input to risk assessment specific to their organization. Consumers may use CVSS information as input to an organizational vulnerability management process that also considers factors that are not part of CVSS in order to rank the threats to their technology infrastructure and make informed remediation decisions. Such factors may include, but are not limited to: regulatory requirements, number of customers impacted, monetary losses due to a breach, life or property threatened, or reputational impacts of a potential exploited vulnerability. These factors are outside the scope of CVSS.
基础指标，以及可选的补充指标，由维护易受攻击系统的组织或代表其进行的第三方评估提供。威胁和环境信息仅对最终消费者可用。CVSS 的消费者应将特定于其易受攻击系统使用的威胁和环境指标值添加到基础指标中，以生成一个更全面的风险评估分数，该分数针对其组织的特定风险。消费者可以使用 CVSS 信息作为输入，用于考虑 CVSS 之外的因素的组织的漏洞管理流程，以对他们的技术基础设施中的威胁进行排序并做出明智的修复决策。这些因素可能包括但不限于：监管要求、受影响的客户数量、因违规造成的经济损失、生命或财产受到威胁，或潜在利用漏洞的声誉影响。这些因素超出了 CVSS 的范围。

The benefits of CVSS include the provisioning of a standardized vendor and platform agnostic vulnerability scoring methodology. It is an open framework, providing transparency to the individual characteristics and methodology used to derive a score.
CVSS 的好处包括提供了一种标准化的、与供应商和平台无关的漏洞评分方法。它是一个开放的框架，提供了对用于得出评分的个体特性和方法的透明度。

Metrics  指标

CVSS is composed of four metric groups: Base, Threat, Environmental, and Supplemental, each consisting of a set of metrics, as shown in Figure 1.
CVSS 由四个度量组组成：基础、威胁、环境和补充，每个组包含一系列度量，如图 1 所示。

Figure 1: CVSS Metric Groups
图 1：CVSS 度量组

The Base metric group represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. It is composed of two sets of metrics: the Exploitability metrics and the Impact metrics.
基础度量组代表漏洞随时间推移和用户环境变化而保持不变的本质特征。它由两组度量指标组成：可利用性指标和影响指标。

The Exploitability metrics reflect the ease and technical means by which the vulnerability can be exploited. That is, they represent characteristics of the “thing that is vulnerable”, which we refer to formally as the “vulnerable system”. The Impact metrics reflect the direct consequence of a successful exploit, and represent the consequence to the “things that suffer the impact”, which may include impact on the vulnerable system and/or the downstream impact on what is formally called the “subsequent system(s)”.
可利用性指标反映了漏洞被利用的容易程度和技术手段。也就是说，它们代表了“易受攻击的事物”的特征，我们正式将其称为“易受攻击的系统”。影响指标反映了成功利用的直接后果，代表了“遭受影响的事物”的后果，这可能包括对易受攻击系统的冲击以及/或对正式称为“后续系统（们）”的下游影响。

While the vulnerable system is typically a software application, operating system, module, driver, etc. (or possibly a hardware device), the subsequent system could be any of those examples but also includes human safety. This potential for measuring the impact of a vulnerability other than the vulnerable system, was a key feature introduced with CVSS v3.0. This property (formerly known as “Scope”), is captured by the separation of impacts to the vulnerable system and to subsequent systems, discussed later.
而受影响的系统通常是软件应用程序、操作系统、模块、驱动程序等（或可能是硬件设备），而后续系统可能是上述任何一种示例，还包括人类安全。除了受影响的系统之外，测量漏洞影响的能力是 CVSS v3.0 引入的关键特性。这一属性（以前称为“范围”），通过将受影响系统与后续系统的影响分开来体现，将在后面讨论。

The Threat metric group reflects the characteristics of a vulnerability related to threat that may change over time but not necessarily across user environments. For example, confirmation that the vulnerability has neither been exploited nor has any proof-of-concept exploit code or instructions publicly available will lower the resulting CVSS score. The values found in this metric group may change over time.
威胁度量组反映了与威胁相关的漏洞特征，这些特征可能随时间变化，但并不一定在用户环境中变化。例如，确认该漏洞尚未被利用，且没有任何公开的证明概念利用代码或指令，将降低由此产生的 CVSS 评分。该度量组中的值可能随时间变化。

The Environmental metric group represents the characteristics of a vulnerability that are relevant and unique to a particular consumers’ environment. Considerations include the presence of security controls which may mitigate some or all consequences of a successful attack, and the relative importance of a vulnerable system within a technology infrastructure.
环境指标组代表与特定消费者环境相关且独特的漏洞特征。考虑因素包括可能减轻成功攻击部分或全部后果的安全控制的存在，以及易受攻击的系统在技术基础设施中的相对重要性。

The Supplemental metric group includes metrics that provide context as well as describe and measure additional extrinsic attributes of a vulnerability. The response to each metric within the Supplemental metric group is to be determined by the CVSS consumer, allowing the usage of an end-user risk analysis system to apply locally significant severity to the metrics and values. No metric will, within its specification, have any impact on the final CVSS score (e.g. CVSS-BTE). Consumer organizations may then assign importance and/or effective impact of each metric, or set/combination of metrics, giving them more, less, or absolutely no effect on the categorization, prioritization, and assessment of the vulnerability. Metrics and values will simply convey additional extrinsic characteristics of the vulnerability itself.
补充指标组包括提供上下文以及描述和测量漏洞额外外在属性的指标。补充指标组中每个指标的反应应由 CVSS 消费者确定，允许使用终端用户风险分析系统将本地重要严重性应用于指标和值。任何指标在其规范中都不会对最终 CVSS 评分（例如 CVSS-BTE）产生任何影响。消费者组织可以随后分配每个指标或指标组合的重要性以及/或有效影响，从而在漏洞的分类、优先级排序和评估上给予它们更多、更少或完全没有影响。指标和值将仅传达漏洞本身额外的外在特征。

Each of these metrics are discussed in further detail below. The User Guide contains scoring rubrics for the Base Metrics that may be useful when scoring.
以下各项指标将在下文进行详细讨论。用户指南包含了基础指标的评分标准，这些标准在评分时可能很有用。

Assessment  评估

When the Base metrics are assigned values by an analyst, the Base metrics assessment results in a score ranging from 0.0 to 10.0.
当分析师为基本指标分配值时，基本指标评估结果得分为 0.0 至 10.0 之间。

The Base metrics assessment can then be further refined by assessing the Threat and Environmental metrics in order to more accurately reflect the relative severity posed by a vulnerability to a user’s environment at a specific point in time. Assessment of the Threat and Environmental metrics is not required, but is highly recommended for more meaningful results.
基础指标评估可以通过评估威胁和环境指标来进一步细化，以便更准确地反映在特定时间点漏洞对用户环境的相对严重性。威胁和环境指标的评估不是必需的，但为了获得更有意义的结果，强烈推荐进行评估。

Generally, the Base metrics are specified by vulnerability bulletin analysts, product vendors, or application vendors because they typically possess the most accurate information about the characteristics of a vulnerability. The Threat and Environmental metrics are specified by consumer organizations because they are best able to assess the potential impact of a vulnerability within their own computing environment, at a given point in time.
通常，基础指标由漏洞公告分析师、产品供应商或应用供应商指定，因为他们通常拥有关于漏洞特性的最准确信息。威胁和环境指标由消费者组织指定，因为他们最能评估在特定时间点其计算环境中漏洞的潜在影响。

Assessing CVSS metrics also produces a vector string, a textual representation of the metric values used to derive a quantitative score and qualitative rating for the vulnerability. This vector string is a specifically formatted text string that contains each value assigned to each metric, and should be displayed with the vulnerability score.
评估 CVSS 度量指标还会生成一个向量字符串，这是用于推导漏洞的定量评分和定性评级的指标值文本表示。该向量字符串是一个特定格式的文本字符串，包含分配给每个指标的价值，并应与漏洞评分一起显示。

The scoring assessment and vector string are explained further below.
评分评估和向量字符串的详细解释见下文。

Note that all metrics should be assessed under the assumption that the attacker has perfect knowledge of the vulnerability. That is, the analyst need not consider the means by which the vulnerability was identified. In addition, it is likely that many different types of individuals will be assessing vulnerabilities (e.g., software vendors, vulnerability bulletin analysts, security product vendors), however, note that CVSS assessment is intended to be agnostic to the individual and their organization.
请注意，所有指标都应在假设攻击者完全了解漏洞的情况下进行评估。也就是说，分析师无需考虑漏洞是如何被发现的。此外，很可能会有许多不同类型的人评估漏洞（例如，软件供应商、漏洞公告分析师、安全产品供应商），然而请注意，CVSS 评估旨在对个人及其组织保持中立。

Nomenclature  学名

Numerical CVSS Scores have very different meanings based on the metrics used to calculate them. Regarding prioritization, the usefulness of a numerical CVSS score is directly proportional to the CVSS metrics leveraged to generate that score. Therefore, numerical CVSS scores should be labeled using nomenclature that communicates the metrics used in its generation.
数值 CVSS 评分根据计算它们的指标具有非常不同的含义。关于优先级，数值 CVSS 评分的有用性与生成该评分所使用的 CVSS 指标成正比。因此，应使用传达其生成所使用指标的命名法来标记数值 CVSS 评分。

CVSS Nomenclature  CVSS 命名法 CVSS Metrics Used  CVSS 度量指标
CVSS-B Base metrics  基础指标
CVSS-BE Base and Environmental metrics
基础和环境指标
CVSS-BT Base and Threat metrics
基础和威胁指标
CVSS-BTE Base, Threat, Environmental metrics
基础，威胁，环境指标

Additional Notes:  附加说明：

Base Metrics  基础指标

Exploitability Metrics  可利用性指标

As previously mentioned, the Exploitability metrics reflect the characteristics of the “thing that is vulnerable”, which we refer to formally as the vulnerable system. Therefore, each of the Exploitability metrics listed below should be assessed relative to the vulnerable system, and reflect the properties of the vulnerability that lead to a successful attack.
如前所述，可利用性指标反映了“易受攻击的事物”的特征，我们正式将其称为易受攻击的系统。因此，以下列出的每个可利用性指标都应相对于易受攻击的系统进行评估，并反映导致成功攻击的漏洞属性。

When assessing Base metrics, it should be assumed that the attacker has advanced knowledge of the target system, including general configuration and default defense mechanisms (e.g., built-in firewalls, rate limits, traffic policing). For example, exploiting a vulnerability that results in repeatable, deterministic success should still be considered a Low value for Attack Complexity, independent of the attacker's knowledge or capabilities. Furthermore, target-specific attack mitigation (e.g., custom firewall filters, access lists) should instead be reflected in the Environmental metric scoring group.
在评估基础指标时，应假定攻击者对目标系统有深入了解，包括一般配置和默认防御机制（例如，内置防火墙、速率限制、流量监控）。例如，利用导致可重复、确定性成功的漏洞，仍应被视为攻击复杂度低，无论攻击者的知识或能力如何。此外，针对特定目标的攻击缓解措施（例如，定制防火墙过滤器、访问列表）应反映在环境指标评分组中。

Specific configurations should not impact any attribute contributing to the CVSS Base metric assessment , i.e., if a specific configuration is required for an attack to succeed, the vulnerable system should be assessed assuming it is in that configuration.
特定配置不应影响对 CVSS 基础度量评估有贡献的任何属性，即如果需要特定配置才能使攻击成功，则应假定受漏洞系统处于该配置下进行评估。

Attack Vector (AV)  攻击向量（AV）

This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity. The list of possible values is presented in Table 1.
此指标反映了利用漏洞的可能性所在的环境。此指标值（以及由此产生的严重性）将随着攻击者距离（逻辑上和物理上）越远而增大。假设可以从网络另一端利用的漏洞的潜在攻击者数量大于需要物理访问设备才能利用的漏洞的潜在攻击者数量，因此需要更高的严重性。可能的值列表见表 1。

Table 1: Attack Vector  表 1：攻击向量

Metric Value  度量值 Description  描述
Network (N)  网络（N） The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service (DoS) by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
易受攻击的系统绑定在网络堆栈上，可能的攻击者范围超出了以下列出的其他选项，直至包括整个互联网。这种漏洞通常被称为“远程可利用”，可以理解为攻击可以在协议级别在一段或多段网络跳数之外（例如，跨越一个或多个路由器）进行利用。网络攻击的一个例子是攻击者通过在一个广域网（例如，CVE-2004-0230）上发送精心制作的 TCP 数据包来造成拒绝服务（DoS）。
Adjacent (A)  相邻（A） The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014).
易受攻击的系统绑定在协议栈上，但攻击在协议级别上仅限于逻辑相邻的拓扑。这意味着攻击必须从相同的共享邻近性（例如，蓝牙、NFC 或 IEEE 802.11）或逻辑网络（例如，本地 IP 子网）发起，或者从安全或受限制的管理域内部（例如，MPLS、管理网络区域内的安全 VPN）发起。相邻攻击的一个例子是 ARP（IPv4）或邻居发现（IPv6）洪水，导致本地 LAN 段拒绝服务（例如，CVE-2013-6014）。
Local (L)  局部（L） The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either:
易受攻击的系统未绑定到网络堆栈，攻击者的路径是通过读写/执行能力。或者：

the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or
攻击者通过本地访问目标系统（例如，键盘、控制台）或通过终端仿真（例如，SSH）来利用漏洞；或者

the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
攻击者依赖于其他人的用户交互来执行利用漏洞所需采取的操作（例如，使用社会工程学技巧欺骗合法用户打开恶意文档）。
Physical (P)  物理（P） The attack requires the attacker to physically touch or manipulate the vulnerable system. Physical interaction may be brief (e.g., evil maid attack1) or persistent. An example of such an attack is a cold boot attack in which an attacker gains access to disk encryption keys after physically accessing the target system. Other examples include peripheral attacks via FireWire/USB Direct Memory Access (DMA).
攻击需要攻击者物理接触或操作易受攻击的系统。物理交互可能短暂（例如，邪恶女仆攻击 1 ）或持续。此类攻击的一个例子是冷启动攻击，攻击者在物理访问目标系统后获取磁盘加密密钥。其他例子包括通过 FireWire/USB 直接内存访问（DMA）的外围攻击。

Assessment Guidance: When deciding between Network and Adjacent, if an attack can be launched over a wide area network or from outside the logically adjacent administrative network domain, use Network.
评估指南：在决定使用网络还是相邻时，如果攻击可以在广域网或从逻辑相邻的行政网络域外部发起，请使用网络。

Attack Complexity (AC)  攻击复杂度（AC）

This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system, and does not relate to the amount of time or attempts it would take for an attacker to succeed, e.g. a race condition. If the attacker does not take action to overcome these conditions, the attack will always fail.
该指标捕捉攻击者必须采取的可测量行动，以积极规避或绕过现有的内置安全增强条件，从而获得一个可用的漏洞利用。这些条件的主要目的是提高安全性和/或增加漏洞利用的复杂性。无需针对特定目标变量即可利用的漏洞比需要非平凡定制的漏洞复杂度低。该指标旨在捕捉易受攻击系统使用的安全机制，并不涉及攻击者成功所需的时间或尝试次数，例如竞争条件。如果攻击者不采取行动克服这些条件，攻击将始终失败。

The evasion or satisfaction of authentication mechanisms or requisites is included in the Privileges Required assessment and is not considered here as a factor of relevance for Attack Complexity.
逃避或满足身份验证机制或要求包含在所需权限评估中，在此不被视为攻击复杂性的相关因素。

Table 2: Attack Complexity
表 2：攻击复杂性

Metric Value  度量值 Description  描述
Low (L)  低（L） The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
攻击者无需采取可测量的行动来利用漏洞。攻击无需针对特定目标的规避措施来利用漏洞。攻击者可以预期在易受攻击的系统上获得可重复的成功。
High (H)  高（H） The successful attack depends on the evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack. These include:
成功的攻击依赖于规避或绕过原本旨在阻碍攻击的安全增强技术。这些包括：

Evasion of exploit mitigation techniques. The attacker must have additional methods available to bypass security measures in place. For example, circumvention of address space randomization (ASLR) or data execution prevention (DEP) must be performed for the attack to be successful.
规避利用缓解技术。攻击者必须拥有额外的方法来绕过现有的安全措施。例如，必须执行地址空间随机化（ASLR）或数据执行预防（DEP）的规避，攻击才能成功。

Obtaining target-specific secrets. The attacker must gather some target-specific secret before the attack can be successful. A secret is any piece of information that cannot be obtained through any amount of reconnaissance. To obtain the secret the attacker must perform additional attacks or break otherwise secure measures (e.g. knowledge of a secret key may be needed to break a crypto channel). This operation must be performed for each attacked target.
获取特定目标的机密信息。攻击者在攻击成功之前必须收集一些特定目标的机密信息。机密信息是指任何无法通过任何侦察手段获取的信息。为了获取机密信息，攻击者必须执行额外的攻击或破坏其他安全措施（例如，可能需要了解一个机密密钥来破坏加密通道）。这项操作必须针对每个攻击目标执行。

As described in Section 2.1, detailed knowledge of the vulnerable system is outside the scope of Attack Complexity. Refer to that section for additional guidance when scoring Attack Complexity when target-specific attack mitigation is present.
如第 2.1 节所述，对易受攻击系统的详细了解超出了攻击复杂度的范围。当存在针对特定目标的攻击缓解措施时，请参阅该部分以获取评分攻击复杂度的额外指导。

Attack Requirements (AT)
攻击需求（AT）

This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system. If the attacker does not take action to overcome these conditions, the attack may succeed only occasionally or not succeed at all.
该指标捕捉了易受攻击系统的先决部署和执行条件或变量，这些条件或变量使得攻击成为可能。这些条件与增强安全性的技术/技术（参见攻击复杂性）不同，因为这些条件的首要目的不是明确减轻攻击，而是作为易受攻击系统部署和执行的自然结果而出现。如果攻击者不采取行动克服这些条件，攻击可能只能偶尔成功，或者根本不成功。

Table 3: Attack Requirements
表 3：攻击要求

Metric Value  度量值 Description  描述
None (N)  无（N） The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
成功的攻击不依赖于易受攻击系统的部署和执行条件。攻击者可以预期在所有或大多数易受攻击的情况下，能够到达漏洞并执行利用。
Present (P)  当前（P） The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack. These include:
成功的攻击依赖于存在特定部署和执行条件，这些条件使得攻击成为可能。这些条件包括：

A race condition must be won to successfully exploit the vulnerability. The successfulness of the attack is conditioned on execution conditions that are not under full control of the attacker. The attack may need to be launched multiple times against a single target before being successful.
为了成功利用漏洞，必须赢得竞争条件。攻击的成功取决于攻击者无法完全控制的执行条件。攻击可能需要针对单个目标多次尝试才能成功。

Network injection. The attacker must inject themselves into the logical network path between the target and the resource requested by the victim (e.g. vulnerabilities requiring an on-path attacker).
网络注入。攻击者必须将自己注入到目标与受害者请求的资源之间的逻辑网络路径中（例如，需要路径攻击者的漏洞）。

Privileges Required (PR)
所需权限（PR）

This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.
此指标描述攻击者在成功利用漏洞之前必须拥有的权限级别。攻击者在攻击之前获取特权凭证的方法（例如，免费试用账户）不在此指标范围内。通常，如果攻击者可以在攻击过程中为自己赋予权限，则自助配置的账户不构成权限要求。

The resulting score is greatest if no privileges are required. The list of possible values is presented in Table 4.
结果分数在无需特权时最大。可能的值列表见表 4。

Table 4: Privileges Required
表 4：所需权限

Metric Value  度量值 Description  描述
None (N)  无（N） The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
攻击者在攻击前未进行身份验证，因此无需访问受侵害系统的设置或文件即可执行攻击。
Low (L)  低（L） The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
攻击者需要提供基本能力的权限，这些能力通常仅限于单个低权限用户拥有的设置和资源。或者，具有低权限的攻击者只能访问非敏感资源。
High (H)  高（H） The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files.
攻击者需要提供显著（例如，管理）控制受侵害系统的权限，允许完全访问受侵害系统的设置和文件。

Assessment Guidance: Privileges Required is usually None for hard-coded credential vulnerabilities or vulnerabilities requiring social engineering (e.g., reflected cross-site scripting, cross-site request forgery, or file parsing vulnerability in a PDF reader). Default credentials that have not been changed or are not unique across each environment should be treated similarly to hard-coded credentials.
评估指南：对于硬编码凭证漏洞或需要社会工程学的漏洞（例如，反射型跨站脚本、跨站请求伪造或 PDF 阅读器中的文件解析漏洞），通常所需的权限为无。未更改或在不同环境中不唯一的默认凭证应类似于硬编码凭证处理。

User Interaction (UI)  用户交互（UI）

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The resulting score is greatest when no user interaction is required. The list of possible values is presented in Table 5.
此指标捕捉了除攻击者之外的人类用户参与成功入侵易受攻击系统的需求。此指标确定漏洞是否可以仅凭攻击者的意愿被利用，或者是否必须由另一个用户（或用户启动的过程）以某种方式参与。当无需用户交互时，所得分数最高。可能的值列表见表 5。

Table 5: User Interaction
表 5：用户交互

Metric Value  度量值 Description  描述
None (N)  无（N） The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
易受攻击的系统可以在没有任何人类用户（除了攻击者）交互的情况下被利用。例如：远程攻击者能够向目标系统发送数据包；本地认证的攻击者执行代码以提升权限。
Passive (P)  被动（P） Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system. Examples include:
成功利用此漏洞需要目标用户与受漏洞影响系统和攻击者载荷之间的有限交互。这些交互被视为非自愿的，不需要用户主动绕过受漏洞影响系统中内置的保护措施。例如包括：

utilizing a website that has been modified to display malicious content when the page is rendered (most stored XSS or CSRF)
利用一个修改过的网站，在页面渲染时显示恶意内容（大多数为存储型 XSS 或 CSRF）

running an application that calls a malicious binary that has been planted on the system
运行一个调用已植根于系统中的恶意二进制文件的程序

using an application which generates traffic over an untrusted or compromised network (vulnerabilities requiring an on-path attacker)
使用一个在不受信任或受损网络（需要路径攻击者的漏洞）上生成流量的应用程序
Active (A)  活跃（A） Successful exploitation of this vulnerability requires a targeted user to perform specific, conscious interactions with the vulnerable system and the attacker’s payload, or the user’s interactions would actively subvert protection mechanisms which would lead to exploitation of the vulnerability. Examples include:
成功利用此漏洞需要目标用户与受漏洞影响的系统和攻击者的有效载荷进行特定、有意识的交互，否则用户的交互将主动破坏保护机制，从而导致漏洞被利用。例如：

importing a file into a vulnerable system in a specific manner
导入文件到特定系统中的脆弱方式

placing files into a specific directory prior to executing code
将文件放置到特定目录中，在执行代码之前

submitting a specific string into a web application (e.g. reflected or self XSS) dismiss or accept prompts or security warnings prior to taking an action (e.g. opening/editing a file, connecting a device).
提交特定字符串到网络应用程序（例如反射型或自发性跨站脚本攻击）中，在执行操作（例如打开/编辑文件、连接设备）之前忽略或接受提示或安全警告。

Impact Metrics  影响指标

The Impact metrics capture the effects of a successfully exploited vulnerability. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.
影响指标捕捉了成功利用漏洞的效果。分析师应将影响限制在合理、最终的结果范围内，他们对此有信心攻击者能够实现。

Only an increase in access, privileges gained, or other negative outcome as a result of successful exploitation should be considered when assessing the Impact metrics of a vulnerability. For example, consider a vulnerability that requires read-only permissions prior to being able to exploit the vulnerability. After successful exploitation, the attacker maintains the same level of read access, and gains write access. In this case, only the Integrity impact metric should be scored, and the Confidentiality and Availability Impact metrics should be set as None.
仅应考虑成功利用漏洞后访问权限增加、获得的特权或其他负面结果，以评估漏洞的影响指标。例如，考虑一个需要读取权限才能利用的漏洞。在成功利用后，攻击者保持相同的读取访问级别，并获得写入权限。在这种情况下，仅应评分完整性影响指标，并将机密性和可用性影响指标设置为无。

Note that when scoring a delta change in impact, the final impact should be used. For example, if an attacker starts with partial access to restricted information (Confidentiality Low) and successful exploitation of the vulnerability results in complete loss in confidentiality (Confidentiality High), then the resultant CVSS Base metric value should reference the “end game” Impact metric value (Confidentiality High).
请注意，在评估影响变化时，应使用最终影响。例如，如果攻击者最初只对受限信息（机密性低）具有部分访问权限，并且成功利用漏洞导致机密性完全丧失（机密性高），则结果 CVSS 基础度量值应参考“最终结果”影响度量值（机密性高）。

When identifying values for the impact metrics, assessment providers need to account for impacts both to the Vulnerable System and impacts outside of the Vulnerable System. These impacts are established by two sets of impact metrics: “Vulnerable System impact” and “Subsequent System impact”. When establishing the boundaries for the Vulnerable System metric values, assessment providers should use the conceptual model of a system of interest.
在确定影响指标值时，评估提供者需要考虑对脆弱系统的影响以及脆弱系统之外的影响。这些影响由两套影响指标确定：“脆弱系统影响”和“后续系统影响”。在确定脆弱系统指标值的边界时，评估提供者应使用感兴趣系统的概念模型。

Formally, a system of interest for scoring a vulnerability is defined as the set of computing logic that executes in an environment with a coherent function and set of security policies. The vulnerability exists in one or more components of such a system. A technology product or a solution that serves a purpose or function from a consumer's perspective is considered a system (e.g., a server, workstation, containerized service, etc.).
正式而言，用于评分漏洞的系统定义为在具有一致功能和安全策略的环境中执行的计算机逻辑集合。漏洞存在于该系统的一个或多个组件中。从消费者角度来看，服务于某种目的或功能的科技产品或解决方案被视为系统（例如，服务器、工作站、容器化服务等）。

When a system provides its functionality solely to another system, or it is designed to be exclusively used by another system, then together they are considered as the system of interest for scoring. For example, a database used solely by a smart speaker is considered a part of that smart speaker system. Both the database and the smart speaker it serves would be considered the vulnerable system if a vulnerability in that database leads to the malfunction of the smart speaker. When a vulnerability does not have impact outside of the vulnerable system assessment providers should leave the subsequent system impact metrics as NONE (N).
当一个系统仅向另一个系统提供其功能，或者它被设计为仅由另一个系统使用时，那么它们共同被视为评分的目标系统。例如，仅由智能音箱使用的数据库被认为是该智能音箱系统的一部分。如果该数据库中的漏洞导致智能音箱故障，那么数据库和它所服务的智能音箱都将被视为易受攻击的系统。当一个漏洞对易受攻击的系统评估没有影响时，应将后续的系统影响指标留空（N）。

All impacts, if any, that occur outside of the vulnerable system should be reflected in the subsequent system impact set. When assessed in the environmental metric group only, the subsequent system impact may, in addition to the logical systems defined for System of Interest, also include impacts to humans. This human impact option in the environmental metric group is explained further in Safety (S), below.
所有发生在易受损害系统之外的影响（如果有的话），应反映在后续的系统影响集中。仅在环境指标组中评估时，除了为感兴趣的系统定义的逻辑系统外，后续系统影响还可能包括对人类的影响。环境指标组中的人类影响选项在以下安全（S）中进一步解释。

Confidentiality (VC/SC)  保密（VC/SC）

This metric measures the impact to the confidentiality of the information managed by the system due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The resulting score is greatest when the loss to the system is highest. The list of possible values is presented in Table 6 (for the Vulnerable System) and Table 7 (when there is a Subsequent System impacted).
此指标衡量系统因成功利用漏洞而对信息保密性的影响。保密性指的是仅限授权用户访问和披露信息，以及防止未授权访问或披露。当系统损失最大时，所得分数最高。可能的值列表见表 6（对于易受攻击的系统）和表 7（当后续系统受到影响时）。

Table 6: Confidentiality Impact to the Vulnerable System (VC)
表 6：对易受攻击系统（VC）的保密性影响

Metric Value  度量值 Description  描述
High (H)  高（H） There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
完全泄露了机密性，导致脆弱系统中的所有信息都被攻击者泄露。或者，仅获取了一些受限制的信息，但泄露的信息产生了直接、严重的影响。例如，攻击者窃取了管理员的密码，或 Web 服务器的私有加密密钥。
Low (L)  低（L） There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Vulnerable System.
存在一些机密性损失。获取了某些受限信息，但攻击者无法控制获取的信息内容，或损失的数量或种类受到限制。信息泄露不会对易受攻击的系统造成直接、严重的损失。
None (N)  无（N） There is no loss of confidentiality within the Vulnerable System.
在脆弱系统中没有机密性损失。

Table 7: Confidentiality Impact to the Subsequent System (SC)
表 7：对后续系统（SC）的保密性影响

Metric Value  度量值 Description  描述
High (H)  高（H） There is a total loss of confidentiality, resulting in all resources within the Subsequent System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
完全泄露了机密性，导致后续系统中的所有资源都被攻击者泄露。或者，仅获取了一些受限信息，但泄露的信息产生了直接、严重的影响。例如，攻击者窃取了管理员的密码，或网页服务器的私有加密密钥。
Low (L)  低（L） There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Subsequent System.
存在一些机密性损失。获取了某些受限信息，但攻击者无法控制获取的信息内容，或损失的数量或种类受到限制。信息泄露不会对后续系统造成直接、严重的损失。
None (N)  无（N） There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
在后续系统中没有机密性损失，或者所有机密性影响都限制在易受攻击系统中。

Integrity (VI/SI)  完整性（VI/SI）

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of a system is impacted when an attacker causes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).
此指标衡量成功利用漏洞对系统完整性的影响。完整性指的是信息的可靠性和真实性。当攻击者导致系统数据未经授权的修改时，系统完整性受到影响。当系统用户可以否认在系统上下文中采取的临界操作（例如，由于日志记录不足）时，完整性也会受到影响。

The resulting score is greatest when the consequence to the system is highest. The list of possible values is presented in Table 8 (for the Vulnerable System) and Table 9 (when there is a Subsequent System impacted).
结果分数在系统影响最大时最高。可能值的列表见表 8（针对易受攻击的系统）和表 9（当后续系统受到影响时）。

Table 8: Integrity Impact to the Vulnerable System (VI)
表 8：对易受攻击系统（VI）的完整性影响

Metric Value  度量值 Description  描述
High (H)  高（H） There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Vulnerable System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Vulnerable System.
完整性完全丧失，或保护完全丧失。例如，攻击者能够修改由易受攻击系统保护的任何/所有文件。或者，只有一些文件可以被修改，但恶意修改将对易受攻击系统产生直接、严重的后果。
Low (L)  低（L） Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System.
数据修改是可能的，但攻击者无法控制修改的结果，或者修改的量是有限的。数据修改对易受攻击的系统没有直接、严重的影响。
None (N)  无（N） There is no loss of integrity within the Vulnerable System.
在脆弱系统中没有完整性损失。

Table 9: Integrity Impact to the Subsequent System (SI)
表 9：对后续系统（SI）的完整性影响

Metric Value  度量值 Description  描述
High (H)  高（H） There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the Subsequent System. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the Subsequent System.
完整性完全丧失，或保护完全丧失。例如，攻击者能够修改后续系统保护的任何/所有文件。或者，只有一些文件可以被修改，但恶意修改将对后续系统产生直接、严重的后果。
Low (L)  低（L） Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Subsequent System.
数据修改是可能的，但攻击者无法控制修改的结果，或者修改的量是有限的。数据修改对后续系统没有直接、严重的影响。
None (N)  无（N） There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
在后续系统中没有完整性损失，或者所有完整性影响都限制在易受攻击系统中。

Availability (VA/SA)  可用性（VA/SA）

This metric measures the impact to the availability of the impacted system resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. The resulting score is greatest when the consequence to the system is highest. The list of possible values is presented in Table 10 (for the Vulnerable System) and Table 11 (when there is a Subsequent System impacted).
此指标衡量成功利用漏洞对受影响系统可用性的影响。虽然机密性和完整性影响指标适用于系统使用的机密性或完整性数据（例如，信息、文件）的丢失，但此指标指的是受影响系统本身可用性的丢失，例如网络服务（例如，网页、数据库、电子邮件）。由于可用性指的是信息资源的可访问性，消耗网络带宽、处理器周期或磁盘空间的攻击都会影响系统的可用性。当对系统的影响最大时，所得分数最高。可能的值列表在表 10（对于易受攻击的系统）和表 11（当有后续系统受到影响时）中给出。

Table 10: Availability Impact to the Vulnerable System (VA)
表 10：对易受攻击系统（VA）的可用性影响

Metric Value  度量值 Description  描述
High (H)  高（H） There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
系统完全失去可用性，导致攻击者能够完全拒绝访问脆弱系统中的资源；这种损失要么持续（攻击者继续发动攻击时），要么持续存在（即使在攻击完成后条件仍然持续）。或者，攻击者有能力拒绝部分可用性，但可用性的损失对脆弱系统产生直接、严重的后果（例如，攻击者无法中断现有连接，但可以阻止新连接；攻击者可以反复利用一个漏洞，在每次成功的攻击中仅泄露少量内存，但经过反复利用会导致服务完全不可用）。
Low (L)  低（L） Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System.
性能降低或资源可用性出现中断。即使可以重复利用漏洞，攻击者也没有完全拒绝合法用户服务的权限。易受攻击系统中的资源要么始终部分可用，要么只在某些时候完全可用，但总体上对易受攻击系统没有直接、严重的后果。
None (N)  无（N） There is no impact to availability within the Vulnerable System.
在易受攻击系统中，对可用性没有影响。

Table 11: Availability Impact to the Subsequent System (SA)
表 11：对后续系统（SA）的可用性影响

Metric Value  度量值 Description  描述
High (H)  高（H） There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Subsequent System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Subsequent System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
系统完全失去可用性，导致攻击者能够完全拒绝后续系统资源的访问；这种损失要么持续（攻击者继续发动攻击时），要么持续存在（即使在攻击完成后条件仍然持续）。或者，攻击者有能力拒绝部分可用性，但可用性的损失对后续系统产生直接、严重的后果（例如，攻击者无法中断现有连接，但可以阻止新连接；攻击者可以反复利用一个漏洞，在每次成功的攻击中仅泄露少量内存，但经过反复利用会导致服务完全不可用）。
Low (L)  低（L） Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Subsequent System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Subsequent System.
性能降低或资源可用性出现中断。即使可以重复利用漏洞，攻击者也没有完全拒绝合法用户服务的权限。后续系统中的资源要么始终部分可用，要么只在某些时候完全可用，但总体上对后续系统没有直接、严重的后果。
None (N)  无（N） There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.
后续系统内没有影响可用性，或者所有可用性影响都限制在易受攻击系统中。

Threat Metrics  威胁指标

The Threat metrics measure the current state of exploit techniques or code availability for a vulnerability.
漏洞威胁指标衡量漏洞利用技术或代码可用性的当前状态。

Exploit Maturity (E)  利用成熟度（E）

This metric measures the likelihood of the vulnerability being attacked, and is based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation. Public availability of easy-to-use exploit code or exploitation instructions increases the number of potential attackers by including those who are unskilled. Initially, real-world exploitation may only be theoretical. Publication of proof-of-concept exploit code, functional exploit code, or sufficient technical details necessary to exploit the vulnerability may follow. Furthermore, the available exploit code or instructions may progress from a proof-of-concept demonstration to exploit code that is successful in exploiting the vulnerability consistently. In severe cases, it may be delivered as the payload of a network-based worm or virus or other automated attack tools.
此指标衡量漏洞被攻击的可能性，基于当前利用技术、利用代码可用性或活跃的“野外”利用状态。易于使用的利用代码或利用说明的公开增加了潜在攻击者的数量，包括那些技术不熟练的人。最初，现实世界的利用可能仅是理论上的。随后可能发布概念验证利用代码、功能利用代码或足够的技术细节，以利用该漏洞。此外，可用的利用代码或说明可能从概念验证演示发展到能够持续利用漏洞的利用代码。在严重情况下，它可能作为基于网络的蠕虫或病毒或其他自动化攻击工具的有效载荷。

It is the responsibility of the CVSS consumer to populate the values of Exploit Maturity (E) based on information regarding the availability of exploitation code/processes and the state of exploitation techniques. This information will be referred to as “threat intelligence” throughout this document.
CVSS 用户有责任根据有关利用代码/流程的可用性和利用技术状态的信息来填写利用成熟度（E）的值。此信息在本文档中将被称为“威胁情报”。

Operational Recommendation: Threat intelligence sources that provide Exploit Maturity information for all vulnerabilities should be preferred over those with only partial coverage. Also, it is recommended to use multiple sources of threat intelligence as many are not comprehensive. This information should be updated as frequently as possible and its application to CVSS assessment should be automated.
操作建议：应优先选择提供所有漏洞利用成熟度信息的威胁情报来源，而不是仅提供部分覆盖的来源。此外，建议使用多个威胁情报来源，因为许多来源并不全面。应尽可能频繁地更新此信息，并将其应用于 CVSS 评估的自动化。

The list of possible values is presented in Table 12. The more easily a vulnerability can be exploited, the higher the vulnerability score.
可能值的列表见表 12。漏洞越容易被利用，漏洞评分就越高。

Table 12: Exploit Maturity
表 12：漏洞成熟度

Metric Value  度量值 Description  描述
Not Defined (X)  未定义（X） Reliable threat intelligence is not available to determine Exploit Maturity characteristics. This is the default value and is equivalent to Attacked (A) for the purposes of the calculation of the score by assuming the worst case.
可靠的威胁情报无法确定漏洞成熟度特征。这是默认值，在计算分数时假设最坏情况，相当于受攻击（A）。
Attacked (A)  攻击（A） Based on available threat intelligence either of the following must apply:
基于可用的威胁情报，以下任一条件必须适用：
Attacks targeting this vulnerability (attempted or successful) have been reported
针对这一漏洞的攻击（尝试或成功）已有报告
Solutions to simplify attempts to exploit the vulnerability are publicly or privately available (such as exploit toolkits)
简化利用漏洞尝试的解决方案公开或私下可用（例如，利用工具包）
Proof-of-Concept (P)  概念验证（P） Based on available threat intelligence each of the following must apply:
基于可用的威胁情报，以下各项必须适用：
Proof-of-concept exploit code is publicly available
概念验证利用代码公开可用
No knowledge of reported attempts to exploit this vulnerability
无关于已报告尝试利用此漏洞的知识
No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., the “Attacked” value does not apply)
无关于用于简化利用漏洞尝试的公开解决方案的知识（即，“攻击”值不适用）
Unreported (U)  未报告（U） Based on available threat intelligence each of the following must apply:
基于可用的威胁情报，以下各项必须适用：
No knowledge of publicly available proof-of-concept exploit code No knowledge of reported attempts to exploit this vulnerability
无公开可用的概念验证漏洞利用代码知识，无关于利用此漏洞的已报告尝试知识
No knowledge of publicly available solutions used to simplify attempts to exploit the vulnerability (i.e., neither the “POC” nor “Attacked” values apply)
无关于用于简化利用漏洞尝试的公开解决方案的知识（即“POC”或“受攻击”值均不适用）

Environmental Metrics  环境指标

These metrics enable the consumer analyst to customize the resulting score depending on the importance of the affected IT asset to a user’s organization, measured in terms of complementary/alternative security controls in place, Confidentiality, Integrity, and Availability. The metrics are the modified equivalent of Base metrics and are assigned values based on the system placement within organizational infrastructure.
这些指标使消费者分析师能够根据受影响的 IT 资产对用户组织的重要性，以现有的补充/替代安全控制措施、机密性、完整性和可用性来定制最终得分。这些指标是修改后的基本指标，并根据系统在组织基础设施中的位置分配值。

Confidentiality, Integrity, and Availability Requirements (CR, IR, AR)
保密性、完整性、可用性要求（CR、IR、AR）

These metrics enable the consumer to customize the assessment depending on the importance of the affected IT asset to the analyst’s organization, measured in terms of Confidentiality, Integrity, and Availability. That is, if an IT asset supports a business function for which Availability is most important, the analyst can assign a greater value to Availability metrics relative to Confidentiality and Integrity. Each Security Requirement has three possible values: Low, Medium, or High, or the default value of Not Defined (X).
这些指标使消费者能够根据受影响的 IT 资产对分析师组织的重要性（以机密性、完整性和可用性来衡量）来定制评估。也就是说，如果 IT 资产支持一个对可用性最重要的业务功能，分析师可以相对于机密性和完整性赋予可用性指标更高的价值。每个安全要求有三个可能的值：低、中或高，或者默认值未定义（X）。

The full effect on the environmental score is determined by the corresponding Modified Base Impact metrics. Following the concept of assuming “reasonable worst case”, in absence of explicit values, these metrics are set to the default value of Not Defined (X), which is equivalent to the metric value of High (H).
环境得分的影响完全由相应的修改后基础影响指标决定。遵循“合理最坏情况”的概念，在缺乏明确值的情况下，这些指标被设置为默认值“未定义（X）”，相当于高（H）的指标值。

The list of possible values is presented in Table 13. For brevity, the same table is used for all three metrics. The lower the Security Requirement, the lower the score (recall that High is considered the default).
可能值列表见表 13。为了简洁，三个指标都使用同一张表。安全要求越低，得分越低（记住，默认为高）。

Table 13: Security Requirements
表 13：安全要求

Metric Value  度量值 Description  描述
Not Defined (X)  未定义（X） This is the default value. Assigning this value indicates there is insufficient information to choose one of the other values. This has the same effect as assigning High as the worst case.
这是默认值。分配此值表示信息不足，无法选择其他值之一。这与将“高”分配为最坏情况的效果相同。
High (H)  高（H） Loss of [Confidentiality | Integrity | Availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
数据[机密性 | 完整性 | 可用性]的丢失可能会对组织或与组织相关联的个人（例如员工、客户）产生灾难性的负面影响。
Medium (M)  中等（M） Loss of [Confidentiality | Integrity | Availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
数据[机密性 | 完整性 | 可用性]的丢失可能会对组织或与组织相关联的个人（例如，员工、客户）产生严重的不利影响。
Low (L)  低（L） Loss of [Confidentiality | Integrity | Availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).
信息[机密性 | 完整性 | 可用性]的丢失可能只会对组织或与组织相关联的个人（例如员工、客户）产生有限的负面影响。

Modified Base Metrics  改进的基础指标

These metrics enable the consumer analyst to override individual Base metric values based on specific characteristics of a user’s environment. Characteristics that affect Exploitability or Impact can be reflected via an appropriately modified Environmental metric value.
这些指标使消费者分析师能够根据用户环境的特定特征覆盖个别基础指标值。影响可利用性或影响特征的指标可以通过相应修改的环境指标值来反映。

The full effect on the resulting score is determined by the corresponding Base metrics as follows
最终得分的全面影响由以下相应的基准指标决定

Example: If a provider sets the Base Metric Privileges Required to Low (PR:L) and an analyst overrides Modified Privileges Required to High (MPR:H), then the resulting score will be calculated as if the Base Metric Privileges Requires was set to High. Similarly, if a provider sets the Base Metric Attack Vector to Network (AV:N) and an analyst sets Modified Attack Vector to Physical (MAV:P), then the resulting score will be calculated as if the Base Attack Vector was set to Physical.
示例：如果提供者将基本度量权限要求设置为低（PR:L），而分析师将修改后的权限要求覆盖为高（MPR:H），则计算出的得分将相当于将基本度量权限要求设置为高。同样，如果提供者将基本度量攻击向量设置为网络（AV:N），而分析师将修改后的攻击向量设置为物理（MAV:P），则计算出的得分将相当于将基本攻击向量设置为物理。

A special case to this rule applies to the Modified Subsequent System Integrity (MSI) and the Modified Subsequent System Availability (MSA) which can be set to an additional special value of Safety (S) which is not included in the Base Subsequent System impact metrics. In this particular case, the special value will be directly used for the calculation of the score as explained in the section 4.2.1 below.
本规则的特殊情况适用于修改后的后续系统完整性（MSI）和修改后的后续系统可用性（MSA），它们可以设置为额外的特殊值“安全”（S），该值不包括在基本后续系统影响指标中。在这种情况下，特殊值将直接用于以下 4.2.1 节中解释的得分计算。

The intent of these metrics are to define the mitigations and compensating controls that are in place for a given environment. It is acceptable to use the modified metrics to represent situations that increase the resulting score. Here are some examples:
这些指标的目的在于定义针对特定环境所实施的缓解措施和补偿控制。使用修改后的指标来表示导致得分增加的情况是可以接受的。以下是一些示例：

Example 1: The default configuration of a component may require high privileges to access a particular function. However, in the consumer analyst’s environment, administrative privileges might be granted by default without authenticating the user. The analyst can set Privileges Required to High and Modified Privileges Required to None to reflect this more serious condition in their particular environment.
示例 1：组件的默认配置可能需要高权限才能访问特定功能。然而，在消费者分析师的环境中，默认情况下可能会授予管理权限而不进行用户验证。分析师可以将“所需权限”设置为“高”，将“修改所需权限”设置为“无”，以反映他们特定环境中的更严重情况。

Example 2: The default configuration for a vulnerable system may be to run a listening service with administrator privileges, for which a compromise might grant an attacker Confidentiality, Integrity, and Availability impacts that are all High. Yet, in the consumer analyst’s environment, that same Internet service might be running with reduced privileges; in that case, the Modified Confidentiality, Modified Integrity, and Modified Availability might each be set to Low.
示例 2：易受攻击系统的默认配置可能是以管理员权限运行监听服务，对此妥协可能使攻击者获得所有均为高级别的机密性、完整性和可用性影响。然而，在消费者分析师的环境中，相同的互联网服务可能以较低权限运行；在这种情况下，修改后的机密性、修改后的完整性和修改后的可用性可能分别被设置为低。

Example 3: Systems and appliances located in an isolated network with no access to or from the Internet are not able to be attacked through the Wide Area Network (WAN). All vulnerabilities found on those systems may have the Attack Vector (AV) values of “Network” reduced to “Adjacent”.
示例 3：位于孤立网络且无法访问或从互联网访问的系统及其设备，无法通过广域网（WAN）遭受攻击。在这些系统上发现的全部漏洞的攻击向量（AV）值可能从“网络”降低到“相邻”。

For brevity, only the names of the Modified Base metrics are mentioned. Each Modified Environmental metric has the same values as its corresponding Base metric, plus values of Not Defined and Safety. Not Defined is the default and uses the metric value of the associated Base metric.
为了简洁，仅提及修改后的基础指标名称。每个修改后的环境指标与其对应的基础指标具有相同的值，加上未定义和安全值。未定义是默认值，使用相关基础指标的指标值。

4.2.1 Modified Base Metrics and Safety
4.2.1 修改后的基本指标与安全性

When a system may have safety implications as a matter of how or where it is deployed, it is possible that exploiting a vulnerability within that system may have safety impact(s) which can be represented in the Environmental Metrics group.
当一个系统可能因为其部署方式或地点而具有安全影响时，利用该系统中的漏洞可能产生安全影响（s），这些影响可以在环境指标组中表示。

If the exploitation of a technical vulnerability (with impact to either the availability or integrity of the vulnerable system) has the potential to impact human safety, the modified subsequent system impact of Safety (s) should be used (i.e., MSI:S/MSA/S).
如果技术漏洞的利用（影响受影响系统的可用性或完整性）可能影响人类安全，则应使用修改后的后续系统影响安全（s）指标（即，MSI：S/MSA/S）。

The Safety metric value measures the impact regarding the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited. Unlike other impact metric values, Safety can only be associated with the Subsequent System impact set and should be considered in addition to the N/L/H impact values for Availability and Integrity metrics.
安全指标值衡量的是由于漏洞被利用而可能可预测受伤的人类行为者或参与者的安全影响。与其他影响指标值不同，安全只能与后续系统影响集相关联，并且应与可用性和完整性指标的 N/L/H 影响值一起考虑。

Note: If Safety is applicable, it should be explicitly assigned even if, and in addition to, impact values of H are already supplied for Availability and Integrity metrics.
注意：如果适用安全，即使已经为可用性和完整性指标提供了 H 的影响值，也应明确分配。

Safety impact is applicable when it is predictable that an exploited vulnerability may result in injuries categorized as Marginal or worse using the IEC 61508 definitions outlined in the chart below.
安全影响适用于以下情况：当可预测利用漏洞可能导致根据下图表中 IEC 61508 定义的边缘或更严重伤害时。

Table 14: IEC 61508 Definitions
表 14：IEC 61508 定义

Category  类别 Definition  定义
Catastrophic  灾难性的 Multiple loss of life
多人死亡
Critical  批判性 Loss of a single life
单条生命的丧失
Marginal  边际 Major injuries to one or more persons
多人重伤
Negligible  微不足道 Minor injuries at worst
最坏的情况是轻微受伤

Note: Safety metric values are leveraged in both the Supplemental Metric Group (provided by the assessment providers) and the Environmental Metric Group (provided by the consumer analyst). The list of possible values is presented below.
注意：安全指标值在补充指标组（由评估提供者提供）和环境指标组（由消费者分析师提供）中均被利用。以下列出了可能的值列表。

Table 15: Modified Base Metrics
表 15：修改后的基本指标

Modified Base Metric  改进的基础指标 Corresponding Values  对应值
Modified Attack Vector (MAV)
改进攻击向量（MAV）		 The same values as the corresponding Base Metric (see Base Metrics, above) as well as Not Defined (the default). Note: For MSC, MSI, and MSA, the lowest metric value is “Negligible” (N), not “None” (N).
与相应的基准指标（见上方的基准指标）相同的值以及未定义（默认）。注意：对于 MSC、MSI 和 MSA，最低指标值是“可忽略”（N），而不是“无”（N）。
Modified Attack Complexity (MAC)
修改后的攻击复杂度（MAC）
Modified Attack Requirements (MAT)
改进攻击需求（MAT）
Modified Privileges Required (MPR)
修改权限要求（MPR）
Modified User Interaction (MUI)
改进的用户交互（MUI）
Modified Vulnerable System Confidentiality (MVC)
修改后的易受攻击系统机密性（MVC）
Modified Vulnerable System Integrity (MVI)
修改后的易受攻击的系统完整性（MVI）
Modified Vulnerable System Availability (MVA)
修改后的易受攻击系统可用性（MVA）
Modified Subsequent System Confidentiality (MSC)
修改后的后续系统机密性（MSC）
Modified Subsequent System Integrity (MSI)
修改后的后续系统完整性（MSI）		 There is also a highest severity level, Safety (S), in addition to the same values as the corresponding Base Metric (High, Medium, Low). The value Not Defined (X) is the default value.
除了与对应的基础指标（高、中、低）相同的值外，还有一个最高严重程度级别，即安全（S）。未定义（X）是默认值。
Modified Subsequent System Availability (MSA)
修改后的后续系统可用性（MSA）

Supplemental Metrics  补充指标

A new, optional metric group called the Supplemental metric group provides new metrics that describe and measure additional extrinsic attributes of a vulnerability. While the assessment of Supplemental metrics is provisioned by the provider, the usage and response plan of each metric within the Supplemental metric group is determined by the consumer. This contextual information may be employed differently in each consumer’s environment. No metric will have any impact on the final calculated CVSS score (e.g. CVSS-BTE). Organizations may then assign importance and/or effective impact of each metric, or set/combination of metrics, giving them more, less, or absolutely no effect on the final risk analysis. Metrics and values will simply convey additional extrinsic characteristics of the vulnerability itself.
一个名为补充度量组的可选度量组提供了描述和衡量漏洞额外外在属性的新度量。虽然补充度量的评估由提供商提供，但补充度量组中每个度量使用的响应计划由消费者决定。这种上下文信息可能在每个消费者的环境中被不同地使用。没有任何度量将对最终计算的 CVSS 得分（例如 CVSS-BTE）产生影响。组织可以分配每个度量或度量组合的重要性以及/或有效影响，从而在最终风险分析中给予它们更多、更少或完全没有影响。度量值将仅传达漏洞本身的额外外在特征。

Safety (S)  安全（S）

Like all Supplemental Metrics, providing a value for Safety is completely optional. Suppliers and vendors (AKA: scoring providers) may or may not provide Safety as a Supplemental Metric as they see fit.
与所有补充指标一样，提供安全性的值完全是可选的。供应商和供应商（即：评分提供商）可以根据自己的意愿决定是否将安全性作为补充指标提供。

When a system does have an intended use or fitness of purpose aligned to safety, it is possible that exploiting a vulnerability within that system may have Safety impact which can be represented in the Supplemental Metrics group. Lack of a Safety metric value being supplied does NOT mean that there may not be any Safety-related impacts. The possible values for the Safety Supplemental Metric are as follows:
当一个系统具有与安全一致的使用目的或适用性时，利用该系统中的漏洞可能对安全产生影响，这种影响可以在补充指标组中表示。未提供安全指标值并不意味着可能没有任何与安全相关的影響。安全补充指标的可能值如下：

Table 16: Safety  表 16：安全性

Metric Value  度量值 Description  描述
Not Defined (X)  未定义（X） The metric has not been evaluated.
该度量尚未评估。
Present (P)  当前（P） Consequences of the vulnerability meet definition of IEC 61508 consequence categories of "marginal," "critical," or "catastrophic."
漏洞的后果符合 IEC 61508 后果类别的“边缘”、“关键”或“灾难性”定义。
Negligible (N)  微不足道（N） Consequences of the vulnerability meet definition of IEC 61508 consequence category "negligible."
漏洞的后果符合 IEC 61508 后果类别“可忽略”的定义。

The Safety supplemental metric value indicates the degree of impact to the Safety of a human actor or participant that can be predictably injured as a result of the vulnerability being exploited.
安全补充指标值表示由于利用漏洞可能导致的可预测伤害，对人类行动者或参与者安全影响的程度。

Note that Safety metrics are defined in both Environmental and Supplemental contexts, although the vector string values differ. As a Supplemental metric, and consistent with the above table, Safety can be described with metric values of S:X, S:P, or S:N.
请注意，安全指标在环境和补充两种情境下均有定义，尽管向量字符串值不同。作为补充指标，并且与上表一致，安全可以描述为 S:X、S:P 或 S:N 的指标值。

The IEC 61508 consequence categories are defined in Table 14 above (as of this writing).
IEC 61508 后果类别定义在上面的表 14 中（截至本文撰写时）。

Automatable (AU)  可自动化（AU）

The “Automatable” metric captures the answer to the question ”Can an attacker automate exploitation events for this vulnerability across multiple targets?” based on steps 1-4 of the kill chain2 [Hutchins et al., 2011]. These steps are reconnaissance, weaponization, delivery, and exploitation. If evaluated, the metric can take the values no or yes:
“可自动化”指标捕捉了以下问题的答案：“攻击者能否自动化针对该漏洞在多个目标上的利用事件？”这是基于杀伤链的第 1-4 步 2 [Hutchins 等人，2011]。这些步骤是侦察、武器化、投递和利用。如果进行评估，该指标可以取“否”或“是”的值：

Table 17: Automatable  表 17：可自动化

Metric Value  度量值 Description  描述
Not Defined (X)  未定义（X） The metric has not been evaluated.
该度量尚未评估。
No (N)  否（N） Attackers cannot reliably automate all 4 steps of the kill chain for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation.
攻击者无法可靠地自动化利用该漏洞的杀伤链的四个步骤，原因不明。这些步骤是侦察、武器化、投递和利用。
Yes (Y)  是（Y） Attackers can reliably automate all 4 steps of the kill chain. These steps are reconnaissance, weaponization, delivery, and exploitation (e.g., the vulnerability is “wormable”).
攻击者可以可靠地自动化杀伤链的四个步骤。这些步骤是侦察、武器化、投递和利用（例如，漏洞是“蠕虫可利用的”）。

Provider Urgency (U)  供应商紧急程度（U）

Many vendors currently provide supplemental severity ratings to consumers via product security advisories. Other vendors publish Qualitative Severity Ratings from the CVSS Specification Document in their advisories.
许多厂商目前通过产品安全公告向消费者提供补充严重性评级。其他厂商在其公告中发布 CVSS 规范文档中的定性严重性评级。

To facilitate a standardized method to incorporate additional provider-supplied assessment, an optional “pass-through” Supplemental Metric called Provider Urgency is available.
为便于采用标准化的方法纳入额外的供应商提供的评估，提供了一个可选的“传递”补充指标，称为“供应商紧急程度”。

Note: While any assessment provider along the product supply chain may provide a Provider Urgency rating:
注意：虽然产品供应链中的任何评估提供者都可能提供供应商紧急度评级：

Library Maintainer → OS/Distro Maintainer → Provider 1 … Provider n (PPP) → Consumer
图书馆维护者 → 操作系统/发行版维护者 → 提供商 1 … 提供商 n（PPP）→ 消费者

The Penultimate Product Provider (PPP) is best positioned to provide a direct assessment of Provider Urgency.
倒数第二个产品提供商（PPP）最适合提供对提供商紧迫性的直接评估。

Table 18: Provider Urgency
表 18：供应商紧急程度

Metric Value  度量值 Description  描述
Not Defined (X)  未定义（X） The metric has not been evaluated.
该度量尚未评估。
Red  红色 Provider has assessed the impact of this vulnerability as having the highest urgency.
供应商已评估此漏洞的影响，认为其具有最高紧急性。
Amber  琥珀 Provider has assessed the impact of this vulnerability as having a moderate urgency.
供应商评估此漏洞的影响，认为其具有中等紧急性。
Green  绿色 Provider has assessed the impact of this vulnerability as having a reduced urgency.
供应商评估此漏洞的影响，认为其紧急程度降低。
Clear  清晰 Provider has assessed the impact of this vulnerability as having no urgency (Informational).
供应商评估此漏洞的影响，认为不具有紧迫性（信息性）。

Recovery (R)  恢复（R）

Recovery describes the resilience of a system to recover services, in terms of performance and availability, after an attack has been performed.
恢复描述系统在遭受攻击后，在性能和可用性方面恢复服务的能力。

Table 19: Recovery  表 19：恢复

Metric Value  度量值 Description  描述
Not Defined (X)  未定义（X） The metric has not been evaluated.
该度量尚未评估。
Automatic (A)  自动（A） The system recovers services automatically after an attack has been performed.
系统在攻击发生后自动恢复服务。
User (U)  用户（U） The system requires manual intervention by the user to recover services, after an attack has been performed.
系统在遭受攻击后需要用户手动干预以恢复服务。
Irrecoverable (I)  不可恢复的（I） The system services are irrecoverable by the user, after an attack has been performed.
系统服务在攻击执行后对用户不可恢复。

Value Density (V)  价值密度（V）

Value Density describes the resources that the attacker will gain control over with a single exploitation event. It has two possible values, diffuse and concentrated:
价值密度描述了攻击者通过单一利用事件将控制的资源。它有两个可能的值，分散和集中：

Table 20: Value Density  表 20：价值密度

Metric Value  度量值 Description  描述
Not Defined (X)  未定义（X） The metric has not been evaluated.
该度量尚未评估。
Diffuse (D)  弥散（D） The vulnerable system has limited resources. That is, the resources that the attacker will gain control over with a single exploitation event are relatively small. An example of Diffuse (think: limited) Value Density would be an attack on a single email client vulnerability.
易受攻击的系统资源有限。也就是说，攻击者通过单一利用事件所能控制的资源相对较小。Diffuse（即有限的）价值密度的一个例子是对单个电子邮件客户端漏洞的攻击。
Concentrated (C)  浓缩（C） The vulnerable system is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users. An example of Concentrated (think: broad) Value Density would be an attack on a central email server.
易受攻击的系统资源丰富。从启发式角度来看，这类系统通常直接由“系统管理员”而非用户负责。集中（想想：广泛）价值密度的一个例子是对中央邮件服务器的攻击。

Vulnerability Response Effort (RE)
漏洞响应努力（RE）

The intention of the Vulnerability Response Effort metric is to provide supplemental information on how difficult it is for consumers to provide an initial response to the impact of vulnerabilities for deployed products and services in their infrastructure. The consumer can then take this additional information on effort required into consideration when applying mitigations and/or scheduling remediation.
漏洞响应努力度指标的目的在于提供补充信息，说明消费者在对其基础设施中部署的产品和服务中漏洞的影响做出初始响应的难度。消费者随后可以将这些关于所需努力程度的额外信息考虑在内，在应用缓解措施和/或安排修复时。

When calculating Vulnerability Response Effort, the effort required to deploy the quickest available response should be considered.
在计算漏洞响应努力时，应考虑部署最快可用响应所需的努力。

Table 21: Vulnerability Response Effort
表 21：漏洞响应努力

Metric Value  度量值 Description  描述
Not Defined (X)  未定义（X） The metric has not been evaluated.
该度量尚未评估。
Low (L)  低（L） The effort required to respond to a vulnerability is low/trivial. Examples include: communication on better documentation, configuration workarounds, or guidance from the vendor that does not require an immediate update, upgrade, or replacement by the consuming entity, such as firewall filter configuration.
应对漏洞所需的工作量低/微不足道。例如：更好的文档沟通、配置解决方案或供应商提供的无需立即更新、升级或更换的指导，例如防火墙过滤器配置。
Moderate (M)  适度（M） The actions required to respond to a vulnerability require some effort on behalf of the consumer and could cause minimal service impact to implement. Examples include: simple remote update, disabling of a subsystem, or a low-touch software upgrade such as a driver update.
应对漏洞所需采取的措施需要消费者付出一定努力，并可能对实施造成最小服务影响。例如：简单的远程更新、禁用子系统或低接触的软件升级，如驱动程序更新。
High (H)  高（H） The actions required to respond to a vulnerability are significant and/or difficult, and may possibly lead to an extended, scheduled service impact. This would need to be considered for scheduling purposes including honoring any embargo on deployment of the selected response. Alternatively, response to the vulnerability in the field is not possible remotely. The only resolution to the vulnerability involves physical replacement (e.g. units deployed would have to be recalled for a depot level repair or replacement). Examples include: a highly privileged driver update, microcode or UEFI BIOS updates, or software upgrades requiring careful analysis and understanding of any potential infrastructure impact before implementation. A UEFI BIOS update that impacts Trusted Platform Module (TPM) attestation without impacting disk encryption software such as Bit locker is a good recent example. Irreparable failures such as non-bootable flash subsystems, failed disks or solid-state drives (SSD), bad memory modules, network devices, or other non-recoverable under warranty hardware, should also be scored as having a High effort.
应对漏洞所需采取的措施重大且/或困难，可能引发长期、计划内的服务影响。这需要在安排时考虑，包括遵守对所选响应部署的任何禁令。或者，现场对漏洞的响应无法远程进行。解决漏洞的唯一方法涉及物理更换（例如，部署的单元必须召回进行仓库级维修或更换）。例如：高度特权的驱动程序更新、微代码或 UEFI BIOS 更新，或需要仔细分析和理解实施前任何潜在基础设施影响的软件升级。一个影响可信平台模块（TPM）认证但不影响磁盘加密软件（如 Bit locker）的 UEFI BIOS 更新是最近的良好例子。不可修复的故障，如无法启动的闪存子系统、失败的磁盘或固态驱动器（SSD）、内存模块损坏、网络设备或其他在保修期下无法恢复的硬件，也应评估为具有高难度。

Qualitative Severity Rating Scale
定性严重程度评分量表

For some purposes it is useful to have a textual representation of the resulting numeric Base, Threat and Environmental scores. All CVSS scores regardless of nomenclature can be mapped to the qualitative ratings defined in Table 22.3
某些目的下，拥有结果数值基础、威胁和环境得分的文本表示是有用的。所有 CVSS 得分，无论命名法如何，都可以映射到表 22 中定义的定性评级。 3

Table 22: Qualitative severity rating scale
表 22：定性严重程度评分量表

Rating  评分 CVSS Score  CVSS 评分
None  无 0.0
Low  低 0.1 - 3.9
Medium  中等 4.0 - 6.9
High  High （由于“High”一词在学术文本中可能有多种含义，如“高度”、“高级”等，以下提供两种可能的翻译，具体取决于上下文：） 高度 高级 7.0 - 8.9
Critical  批判性 9.0 - 10.0

As an example, a CVSS Base Score of 5.0 has an associated severity rating of Medium. The use of these qualitative severity ratings is optional, and there is no requirement to include them when publishing CVSS scores. They are intended to help organizations properly assess and prioritize their vulnerability management processes.
例如，CVSS 基础评分为 5.0 时，对应的严重程度评分为中等。使用这些定性严重程度评级是可选的，发布 CVSS 评分时无需包含它们。它们旨在帮助组织正确评估和优先处理其漏洞管理流程。

Vector String  向量字符串

The CVSS v4.0 vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise and machine-readable form.
CVSS v4.0 向量字符串是一组 CVSS 度量值的文本表示。它通常用于以简洁和机器可读的形式记录或传输 CVSS 度量值信息。

The CVSS v4.0 vector string begins with the label “CVSS:” and a numeric representation of the current version, “4.0”. Metric information follows in the form of a set of metrics, each preceded by a forward slash, “/”, acting as a delimiter. Each metric is a metric name in abbreviated form, a colon (“:”), and its associated metric value in abbreviated form. The abbreviated forms are defined earlier in this specification (in parentheses after each metric name and metric value, case sensitive), and are summarized in the table below.
CVSS v4.0 向量字符串以标签“CVSS:”和当前版本数字表示“4.0”开始。随后是指标信息，以一组指标的形式呈现，每个指标前有一个正斜杠“/”作为分隔符。每个指标是一个缩写形式的指标名称，一个冒号（“:”），以及其关联的缩写形式的指标值。缩写形式在本规范中定义（在每个指标名称和指标值之后括号内，区分大小写），并在下表中进行总结。

A vector string must contain metrics in the order shown in Table 23, every other ordering is invalid. All Base metrics must be included in a vector string. Threat, Environmental, and Supplemental metrics are optional, and omitted metrics are considered to have the value of Not Defined (X). Metrics with a value of Not Defined can be explicitly included in a vector string if desired. Systems that produce or consume CVSS v4.0 vector strings must do so in the following order and treat unspecified Threat, Environmental and Supplemental as Not Defined. A vector string must not include the same metric more than once.
一个向量字符串必须按照表 23 所示的顺序包含指标，其他任何顺序都是无效的。所有基本指标都必须包含在向量字符串中。威胁、环境和补充指标是可选的，省略的指标被视为未定义（X）。如果需要，可以明确地将未定义值的指标包含在向量字符串中。生成或消耗 CVSS v4.0 向量字符串的系统必须按照以下顺序进行，并将未指定的威胁、环境和补充视为未定义。向量字符串不得包含相同的指标超过一次。

Table 23: Base, Threat and Environmental Vectors
表 23：基础、威胁和环境向量

Metric Group  度量组 Metric Name (and Abbreviated Form)
指标名称（及缩写形式）		 Possible Values  可能值 Mandatory?  强制性的？
Base  基础 Attack Vector (AV)  攻击向量（AV） [N,A,L,P] Yes  是的
- Attack Complexity (AC)  攻击复杂度（AC） [L,H]  [左，右] Yes  是的
- Attack Requirements (AT)
攻击需求（AT）		 [N,P]  [ N, P ] Yes  是的
- Privileges Required (PR)
所需权限（PR）		 [N,L,H]  [ N, L, H ] Yes  是的
- User Interaction (UI)  用户交互（UI） [N,P,A]  [ N, P, A ] Yes  是的
- Vulnerable System Confidentiality Impact (VC)
易受攻击系统机密性影响（VC）		 [H,L,N]  [H, L, N] Yes  是的
- Vulnerable System Integrity Impact (VI)
易受攻击的系统完整性影响（VI）		 [H,L,N]  [H, L, N] Yes  是的
- Vulnerable System Availability Impact (VA)
易受攻击系统可用性影响（VA）		 [H,L,N]  [H, L, N] Yes  是的
- Subsequent System Confidentiality Impact (SC)
后续系统机密性影响（SC）		 [H,L,N]  [H, L, N] Yes  是的
- Subsequent System Integrity Impact (SI)
后续系统完整性影响（SI）		 [H,L,N]  [H, L, N] Yes  是的
- Subsequent System Availability Impact (SA)
后续系统可用性影响（SA）		 [H,L,N]  [H, L, N] Yes  是的
Threat  威胁 Exploit Maturity (E)  利用成熟度（E） [X,A,P,U]  [X, A, P, U] No  没有
Environmental  环境 Confidentiality Requirement (CR)
保密性要求（CR）		 [X,H,M,L]  [X, H, M, L] No  没有
- Integrity Requirement (IR)
完整性要求（IR）		 [X,H,M,L]  [X, H, M, L] No  没有
- Availability Requirement (AR)
可用性需求（AR）		 [X,H,M,L]  [X, H, M, L] No  没有
- Modified Attack Vector (MAV)
改进攻击向量（MAV）		 [X,N,A,L,P]  [X, N, A, L, P] No  没有
- Modified Attack Complexity (MAC)
修改后的攻击复杂度（MAC）		 [X,L,H]  [X, L, H] No  没有
- Modified Attack Requirements (MAT)
改进攻击需求（MAT）		 [X,N,P]  [X, N, P] No  没有
- Modified Privileges Required (MPR)
修改权限要求（MPR）		 [X,N,L,H]  [X, N, L, H] No  没有
- Modified User Interaction (MUI)
改进的用户交互（MUI）		 [X,N,P,A]  [X, N, P, A] No  没有
- Modified Vulnerable System Confidentiality (MVC)
修改后的易受攻击系统机密性（MVC）		 [X,N,L,H]  [X, N, L, H] No  没有
- Modified Vulnerable System Integrity (MVI)
修改后的易受攻击的系统完整性（MVI）		 [X,N,L,H]  [X, N, L, H] No  没有
- Modified Vulnerable System Availability (MVA)
修改后的易受攻击系统可用性（MVA）		 [X,N,L,H]  [X, N, L, H] No  没有
- Modified Subsequent System Confidentiality (MSC)
修改后的后续系统机密性（MSC）		 [X,N,L,H]  [X, N, L, H] No  没有
- Modified Subsequent System Integrity (MSI)
修改后的后续系统完整性（MSI）		 [X,N,L,H,S]  [X, N, L, H, S] No  没有
- Modified Subsequent System Availability (MSA)
修改后的后续系统可用性（MSA）		 [X,N,L,H,S]  [X, N, L, H, S] No  没有
Supplemental  补充 Safety (S)  安全（S） [X,N,P]  [X, N, P] No  没有
- Automatable (AU)  可自动化（AU） [X,N,Y]  [X, N, Y] No  没有
- Recovery (R)  恢复（R） [X,A,U,I]  [X, A, U, I] No  没有
- Value Density (V)  价值密度（V） [X,D,C]  [X, D, C] No  没有
- Vulnerability Response Effort (RE)
漏洞响应努力（RE）		 [X,L,M,H]  [X, L, M, H] No  没有
- Provider Urgency (U)  供应商紧急程度（U） [X,Clear,Green,Amber,Red]
[X, 清，绿，黄，红]		 No  没有

For example, a vulnerability with Base metric values of:
例如，一个基度量值为：

The following examples are valid CVSS v4.0 vectors, provided along a short description:
以下示例是有效的 CVSS v4.0 向量，附带简要描述：

The following vectors are invalid and are provided along a short explanation:
以下向量无效，并附有简要说明：

CVSS v4.0 Scoring  CVSS v4.0 评分

The CVSS v4.0 scoring methodologies are described in the sub-sections below.
以下子节中描述了 CVSS v4.0 评分方法。

New Scoring System Development
新评分系统开发

The scoring system development for CVSS v4.0 consisted of the following broad steps:
CVSS v4.0 评分系统开发包括以下几个主要步骤：

  1. Use metric groups to gather the 15 million CVSS-BTE vectors into 270 disjoint equivalence sets under a relation of comparable qualitative severity
    使用度量组将 1500 万个 CVSS-BTE 向量根据可比的定性严重程度关系划分为 270 个不相交的等价集

  2. Solicit experts to compare vectors representing each equivalence set
    征求专家比较代表每个等价类向量的向量

  3. Use the expert comparison data to calculate an order of vectors from least severe to most severe
    利用专家比较数据，从最轻微到最严重计算向量顺序

  4. Solicit expert opinion to decide which equivalence set of vectors p in the ordering of vectors represents the boundary between qualitative severity scores to be backwards compatible with qualitative severity score boundaries from CVSS v3.x
    征求专家意见，以确定在向量排序中，哪个向量 p 的等价集代表与 CVSS v3.x 的定性严重程度得分边界向后兼容的定性严重程度得分边界。

  5. Compress the equivalence set of vectors in each qualitative severity bin into the number of available scores in that bin (for example, 9.0 to 10.0 for critical, 7.0 to 8.9 for high, etc.)
    将每个定性严重程度区间的向量等价集压缩为该区间内可用的分数数量（例如，对于关键，9.0 到 10.0；对于高，7.0 到 8.9 等）。

  6. Create a small score modification factor that adjusts the scores of vectors within a qualitatively equivalent set of vectors so that a change of any metric value results in a resulting score change, where possible. The intent is that the score change is not larger than the uncertainty in the ranking of the vector groups as collected from the expert comparison data in step 2. This is further discussed in section 8.2 below.
    创建一个小的评分调整因子，以调整在定性等效向量集中的一组向量的分数，使得任何度量值的变化都导致相应的分数变化，在可能的情况下。目的是分数变化不超过从步骤 2 中收集的专家比较数据中向量组排名的不确定性。这将在下面的 8.2 节中进一步讨论。

Additional information about the new approach to scoring calculation developed in CVSS v4.0 can be found in Section 2.5 of the CVSS v4.0 User Guide.
关于 CVSS v4.0 中开发的新评分计算方法的相关附加信息，可在 CVSS v4.0 用户指南的第 2.5 节中找到。

CVSS v4.0 Scoring using MacroVectors and Interpolation
CVSS v4.0 使用宏向量和插值评分

The CVSS v4.0 formula provides a mathematical approximation of all possible metric combinations ranked in order of severity where vectors are clustered in sets called MacroVectors. A MacroVector is one of the sets of CVSS vectors that the expert evaluation process described in section 8.1 (steps 1-3) determined to be of comparable qualitative severity. Each MacroVector constitutes an equivalence class4 from such a qualitative perspective.
CVSS v4.0 公式提供了一个数学近似，将所有可能的指标组合按严重程度排序，其中向量被聚类成称为宏向量的集合。宏向量是 CVSS 向量集合之一，根据第 8.1 节（步骤 1-3）中描述的专家评估过程，被认为具有可比的定性严重程度。每个宏向量构成一个从这种定性角度的等价类 4 。

The score of a MacroVector is defined by a lookup table as defined by the subject matter expert process mentioned above and is specified in Section 8.3. The score of a vector within each MacroVector is defined by interpolation.
宏向量的得分由上述主题专家过程定义的查找表确定，并在第 8.3 节中指定。每个宏向量内向量的得分由插值定义。

To determine a preliminary set of relevant MacroVectors, The SIG determined the following preliminary metrics subgroups. Additional EQs or levels can be determined for a finer resolution.
为了确定一组初步的相关宏向量，SIG 确定了以下初步的指标子组。可以进一步确定额外的 EQ 或级别以获得更精细的分辨率。

Intuitively, each level of a metric subgroup corresponds to a different severity level with zero being the most severe and one or two being the least severe.
直观上，度量子群的每一级对应不同的严重程度，其中零级是最严重的，而一或二级是最轻微的。

Since EQ3 and EQ6 are not independent they must be considered together
由于 EQ3 和 EQ6 不独立，必须将它们一起考虑

A highest severity vector of a MacroVector is a vector that
一个 MacroVector 的最高严重性向量是一个向量，其严重性最高

The lowest severity vector of a MacroVector is determined in a similar way.
宏向量的最低严重性向量以类似的方式确定。

One MacroVector might have more than one highest severity vector and more than one lowest severity vector. For example the MacroVectors which satisfy EQ1 at level 1 shown in Table 24 have as highest severity vectors all vectors with
一个 MacroVector 可能包含多个最高严重性向量和多个最低严重性向量。例如，满足 EQ1 在第 1 级条件的表 24 中的 MacroVectors，其最高严重性向量包括所有向量，

as they all satisfy the constraints specified in Table 24.
它们都满足表 24 中指定的约束条件。

Table 24: EQ1 - MacroVectors
表 24：EQ1 - 宏向量

Levels  层级 Constraints  约束条件 Highest Severity Vector(s)
最高严重性向量
0 AV:N and PR:N and UI:N
AV:N 和 PR:N 和 UI:N		 AV:N/PR:N/UI:N  AV:N/PR:N/UI:N 攻击向量：网络 权限要求：无 用户交互：无
1 (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P
(AV:N 或 PR:N 或 UI:N) 且非 (AV:N 且 PR:N 且 UI:N) 且非 AV:P		 AV:A/PR:N/UI:N or AV:N/PR:L/UI:N or AV:N/PR:N:/UI:P
AV:A/PR:N/UI:N 或 AV:N/PR:L/UI:N 或 AV:N/PR:N/UI:P
2 AV:P or not(AV:N or PR:N or UI:N)
AV:P 或非(AV:N 或 PR:N 或 UI:N)		 AV:P/PR:N/UI:N or AV:A/PR:L/UI:P
AV:P/PR:N/UI:N 或 AV:A/PR:L/UI:P

Table 25: EQ2 - MacroVectors
表 25：EQ2 - 宏向量

Levels  层级 Constraints  约束条件 Highest Severity Vector(s)
最高严重性向量
0 AC:L and AT:N  AC:L 和 AT:N AC:L/AT:N  AC: L/AT: N
1 not (AC:L and AT:N)
非(AC:L 且 AT:N)		 AC:L/AT:P or AC:H/AT:N  AC:L/AT:P 或 AC:H/AT:N

Table 26: EQ3 - MacroVectors
表 26：EQ3 - 宏向量

Levels  层级 Constraints  约束条件 Highest Severity Vector(s)
最高严重性向量
0 VC:H and VI:H  VC:H 和 VI:H VC:H/VI:H/VA:H  VC:H/VI:H/VA:H：VC：高/VI：高/VA：高
1 not (VC:H and VI:H) and (VC:H or VI:H or VA:H)
非(VC:H 且 VI:H) 且 (VC:H 或 VI:H 或 VA:H)		 VC:L/VI:H/VA:H or VC:H/VI:L/VA:H
VC:L/VI:H/VA:H 或 VC:H/VI:L/VA:H
2 not (VC:H or VI:H or VA:H)
非(VC:H 或 VI:H 或 VA:H)		 VC:L/VI:L/VA:L  VC:L/VI:L/VA:L：VC:L/VI:L/VA:L

Table 27: EQ4 - MacroVectors
表 27：EQ4 - 宏向量

Levels  层级 Constraints  约束条件 Highest Severity Vector(s)
最高严重性向量
0 MSI:S or MSA:S  MSI：S 或 MSA：S SC:H/SI:S/SA:S  SC: 比率/H/SI: 比率/S/SA: 比率
1 not (MSI:S or MSA:S) and (SC:H or SI:H or SA:H)
非（MSI：S 或 MSA：S）且（SC：H 或 SI：H 或 SA：H）		 SC:H/SI:H/SA:H  SC：高/H/SI：高/SA：高
2 not (MSI:S or MSA:S) and not (SC:H or SI:H or SA:H)
非(MSI:S 或 MSA:S) 且 非(SC:H 或 SI:H 或 SA:H)		 SC:L/SI:L/SA:L  SC:全双工/单工:无/单工:无/单工:无

If MSI=X or MSA=X they will default to the corresponding value of SI and SA according to the rules of Modified Base Metrics in section 4.2 (See Table 15). So if there are no modified base metrics, the highest value that EQ4 can reach is 1.
如果 MSI=X 或 MSA=X，它们将根据第 4.2 节中修改后的基础度量规则默认为 SI 和 SA 的相应值（参见表 15）。因此，如果没有修改后的基础度量，EQ4 可以达到的最高值是 1。

Table 28: EQ5 - MacroVectors
表 28：EQ5 - 宏向量

Levels  层级 Constraints  约束条件 Highest Severity Vector(s)
最高严重性向量
0 E:A  E: E E:A  E: E
1 E:P  E:P：E:P E:P  E:P：E:P
2 E:U  E:U （由于 "E:U" 可能是一个缩写或专有名词，没有上下文无法确定其具体含义，因此保持原文不变。） E:U  E:U （由于 "E:U" 可能是一个缩写或专有名词，没有上下文无法确定其具体含义，因此保持原文不变。）

If E=X it will default to the worst case (i.e., E=A).
如果 E=X，则将默认为最坏情况（即，E=A）。

Table 29: EQ6 - MacroVectors
表 29：EQ6 - 宏向量

Levels  层级 Constraints  约束条件 Highest Severity Vector(s)
最高严重性向量
0 (CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)
(CR:H 和 VC:H) 或 (IR:H 和 VI:H) 或 (AR:H 和 VA:H)		 VC:H/VI:H/VA:H/CR:H/IR:H/AR:H
VC:H/VI:H/VA:H/CR:H/IR:H/AR:H 电压：高/绝缘：高/电压衰减：高/电流：高/电阻：高
1 not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)
非(CR:H 且 VC:H) 且 非(IR:H 且 VI:H) 且 非(AR:H 且 VA:H)		 VC:H/VI:H/VA:H/CR:M/IR:M/AR:M or VC:H/VI:H/VA:L/CR:M/IR:M/AR:H or VC:H/VI:L/VA:H/CR:M/IR:H/AR:M or VC:H/VI:L/VA:L/CR:M/IR:H/AR:H or VC:L/VI:H/VA:H/CR:H/IR:M/AR:M or VC:L/VI:H/VA:L/CR:H/IR:M/AR:H or VC:L/VI:L/VA:H/CR:H/IR:H/AR:M or VC:L/VI:L/VA:L/CR:H/IR:H/AR:H
VC:H/VI:H/VA:H/CR:M/IR:M/AR:M 或 VC:H/VI:H/VA:L/CR:M/IR:M/AR:H 或 VC:H/VI:L/VA:H/CR:M/IR:H/AR:M 或 VC:H/VI:L/VA:L/CR:M/IR:H/AR:H 或 VC:L/VI:H/VA:H/CR:H/IR:M/AR:M 或 VC:L/VI:H/VA:L/CR:H/IR:M/AR:H 或 VC:L/VI:L/VA:H/CR:H/IR:H/AR:M 或 VC:L/VI:L/VA:L/CR:H/IR:H/AR:H

If CR=X, IR=X or AR=X they will default to the worst case (i.e., CR=H, IR=H and AR=H).
如果 CR=X，IR=X 或 AR=X，它们将默认为最坏情况（即，CR=H，IR=H 和 AR=H）。

Table 30: Joint EQ3+EQ6 - MacroVectors
表 30：联合 EQ3+EQ6 - 宏向量

Levels  层级 Constraints  约束条件 Highest Severity Vector(s)
最高严重性向量
00 VC:H and VI:H and [CR:H or IR:H or (AR:H and VA:H)]
VC:H 和 VI:H 和 [CR:H 或 IR:H 或 (AR:H 且 VA:H)]		 VC:H/VI:H/VA:H/CR:H/IR:H/AR:H
VC:H/VI:H/VA:H/CR:H/IR:H/AR:H 电压：高/绝缘：高/电压衰减：高/电流：高/电阻：高
01 VC:H and VI:H and not (CR:H or IR:H) and not (AR:H and VA:H)
VC:H 和 VI:H 且非 (CR:H 或 IR:H) 且非 (AR:H 且 VA:H)		 VC:H/VI:H/VA:H/CR:M/IR:M/AR:M or VC:H/VI:H/VA:L/CR:M/IR:M/AR:H
VC:H/VI:H/VA:H/CR:M/IR:M/AR:M 或 VC:H/VI:H/VA:L/CR:M/IR:M/AR:H
10 not (VC:H and VI:H) and (VC:H or VI:H or VA:H) and [(CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)]
非(VC:H 且 VI:H) 且 (VC:H 或 VI:H 或 VA:H) 且 [(CR:H 且 VC:H) 或 (IR:H 且 VI:H) 或 (AR:H 且 VA:H)]		 VC:L/VI:H/VA:H/CR:H/IR:H/AR:H or VC:H/VI:L/VA:H/CR:H/IR:H/AR:H
VC:L/VI:H/VA:H/CR:H/IR:H/AR:H 或 VC:H/VI:L/VA:H/CR:H/IR:H/AR:H
11 not (VC:H and VI:H) and (VC:H or VI:H or VA:H) and [not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)]
非(VC:H 且 VI:H) 且 (VC:H 或 VI:H 或 VA:H) 且 [非(CR:H 且 VC:H) 且 非(IR:H 且 VI:H) 且 非(AR:H 且 VA:H)]		 VC:H/VI:L/VA:H/CR:M/IR:H/AR:M or VC:H/VI:L/VA:L/CR:M/IR:H/AR:H or VC:L/VI:H/VA:H/CR:H/IR:M/AR:M or VC:L/VI:H/VA:L/CR:H/IR:M/AR:H or VC:L/VI:L/VA:H/CR:H/IR:H/AR:M
VC:H/VI:L/VA:H/CR:M/IR:H/AR:M 或 VC:H/VI:L/VA:L/CR:M/IR:H/AR:H 或 VC:L/VI:H/VA:H/CR:H/IR:M/AR:M 或 VC:L/VI:H/VA:L/CR:H/IR:M/AR:H 或 VC:L/VI:L/VA:H/CR:H/IR:H/AR:M
20 not (VC:H or VI:H or VA:H) and [(CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)]
非(VC:H 或 VI:H 或 VA:H)且[(CR:H 且 VC:H)或(IR:H 且 VI:H)或(AR:H 且 VA:H)]		 Cannot exist  无法存在
21 not (VC:H or VI:H or VA:H) and not (CR:H and VC:H) and not (IR:H and VI:H) and not (AR:H and VA:H)
非(VC:H 或 VI:H 或 VA:H) 且 非(CR:H 且 VC:H) 且 非(IR:H 且 VI:H) 且 非(AR:H 且 VA:H)		 VC:L/VI:L/VA:L/CR:H/IR:H/AR:H
VC:L/VI:L/VA:L/CR:H/IR:H/AR:H 控制变量：低/变量间关系：低/变量间关联：低/控制率：高/内部相关：高/关联率：高

Given two vectors the severity distance between them is the number of consecutive stepwise changes in individual metrics given Section 2 ordering needed to transform one vector into the other.
给定两个向量，它们之间的严重距离是在第 2 节排序下，将一个向量转换为另一个向量所需的连续逐步变化在各个指标中的数量。

For example a Vector with VC:H/VI:H/VA:H has a severity distance of 3 from a vector that contains VC:H/VI:L/VA:N and is otherwise identical
例如，一个具有 VC:H/VI:H/VA:H 的向量与一个包含 VC:H/VI:L/VA:N 且其他方面相同的向量相比，严重程度距离为 3

The depth of a MacroVector is the maximum severity distance between the highest severity vector(s) and the lowest severity vector(s) of the MacroVector.
宏向量的深度是最高严重程度向量与最低严重程度向量之间的最大严重程度距离。

The notion of depth can be better understood by a graphical visualization. For example consider EQ3=2 which is defined in Table 26 as all metrics values such that not (VC=H or VI=H or VA=H). Figure 2 shows all metric values of VC, VI, and VA in that MacroVector starting from the highest severity vector (VC:L/VI:L/VA:L) to the lowest severity vector (VC:N/VI:N/VA:N).
深度概念可以通过图形可视化更好地理解。例如，考虑表 26 中定义的 EQ3=2，它表示所有不符合（VC=H 或 VI=H 或 VA=H）的度量值。图 2 显示了该 MacroVector 中 VC、VI 和 VA 的所有度量值，从最严重向量（VC:L/VI:L/VA:L）到最不严重向量（VC:N/VI:N/VA:N）。

Figure 2: Vectors included MacroVector with EQ3=2 and everything else fixed.
图 2：包含 EQ3=2 的 MacroVector 向量以及所有其他参数固定。

The highest severity vector of a MacroVector is always assigned the score of the MacroVector from the cvss_lookup.js file within the CVSS v4.0 calculator reference implementation available on GitHub (see Section 8.3).
一个 MacroVector 的最高严重性向量始终被分配 CVSS v4.0 计算器参考实现中 cvss_lookup.js 文件内的 MacroVector 的分数（见第 8.3 节）。

A vector within a MacroVector is assigned the score of the highest severity vector in the MacroVector minus the mean proportional distance from the MacroVectors below it.
一个宏向量中的向量被分配的分数是宏向量中最严重向量分数减去从其下方的宏向量到该向量的平均比例距离。

This is obtained by the following algorithm.
这是通过以下算法获得的。

  1. For each of the EQs
    对于每个 EQ

    1. The maximal scoring difference is determined as the difference between the current MacroVector and the lower MacroVector
      最大得分差异定义为当前宏向量与较低宏向量之间的差异

      1. if there is no lower MacroVector the available distance is set to NaN and then ignored in the further calculations
        如果没有更低的 MacroVector，则可用的距离被设置为 NaN，并在后续计算中被忽略

    2. The severity distance of the to-be scored vector from a highest severity vector in the same MacroVector is determined
      待评分向量与同一 MacroVector 中最高严重性向量的严重性距离确定

    3. The proportion of the distance is determined by dividing the severity distance of the to-be-scored vector by the depth of the MacroVector
      距离比例由待评分向量的严重距离除以 MacroVector 的深度确定

    4. The maximal scoring difference is multiplied by the proportion of distance
      最大得分差异乘以距离比例

  2. The mean of the above computed proportional distances is computed
    上述计算出的比例距离的平均值被计算

  3. The score of the vector is the score of the MacroVector (i.e. the score of the highest severity vector) minus the mean distance so computed. This score is rounded to one decimal place.
    向量的得分为宏向量（即最高严重性向量的得分）减去所计算的均值距离。此得分四舍五入到小数点后一位。

Scores of all MacroVectors
所有宏向量的得分

A complete list of all MacroVectors and associated scores can be found in the cvss_lookup.js file within the CVSS v4.0 calculator reference implementation available on GitHub:
完整的所有宏向量和相关分数列表可在 GitHub 上 CVSS v4.0 计算器参考实现中的 cvss_lookup.js 文件中找到：

https://github.com/FIRSTdotorg/cvss-v4-calculator/blob/main/cvss_lookup.js

Appendix A - Acknowledgments
附录 A - 致谢

FIRST sincerely recognizes the contributions of the following CVSS Special Interest Group (SIG) members, listed in alphabetical order by last name:
首先真诚地认可以下按姓氏字母顺序排列的 CVSS 特别兴趣小组（SIG）成员的贡献：

FIRST would also like to thank Grace Staley from CAPS, LLC. for her tireless work facilitating the CVSS SIG meetings.
FIRST 还想要感谢 CAPS, LLC 的 Grace Staley，感谢她在 CVSS SIG 会议组织工作中付出的不懈努力。

Appendix B - On-Line Resources
附录 B - 在线资源

CVSS v4.0 main page - https://www.first.org/cvss/v4-0
CVSS v4.0 主页 - https://www.first.org/cvss/v4-0

The main web page for all CVSS resources, including the most recent version of the CVSS standard.
所有 CVSS 资源的主网页，包括最新的 CVSS 标准版本。

CVSS v4.0 Specification Document - https://www.first.org/cvss/v4-0/specification-document
CVSS v4.0 规范文档 - https://www.first.org/cvss/v4-0/specification-document

The latest revision of this document, defining the metrics, formulas, qualitative rating scale and vector string.
本文件的最新修订版，定义了指标、公式、定性评分尺度和向量字符串。

CVSS v4.0 User Guide - https://www.first.org/cvss/v4-0/user-guide
CVSS v4.0 用户指南 - https://www.first.org/cvss/v4-0/user-guide

A companion to the Specification, the User Guide includes further discussion of the CVSS standard including particular use cases, guidelines on scoring, scoring rubrics, and a glossary of the terms used in the Specification and User Guide documents.
《规范》的配套指南，包括对 CVSS 标准的进一步讨论，特定用例，评分指南，评分标准以及规范和指南文档中使用的术语表。

CVSS v4.0 Examples Document - https://www.first.org/cvss/v4-0/examples
CVSS v4.0 示例文档 - https://www.first.org/cvss/v4-0/examples

Includes scores of public vulnerabilities and explanations of why particular metric values were chosen.
包括大量公共漏洞及其选择特定指标值的原因解释。

CVSS v4.0 Calculator - https://www.first.org/cvss/calculator/v4-0
CVSS v4.0 计算器 - https://www.first.org/cvss/calculator/v4-0

A reference implementation of the CVSS standard that can be used for generating scores. The underlying code is documented and can be used as part of other implementations.
CVSS 标准的一个参考实现，可用于生成评分。其底层代码已文档化，可作为其他实现的一部分使用。

JSON and XML Schemas - https://www.first.org/cvss/data-representations
JSON 和 XML 模式 - https://www.first.org/cvss/data-representations

Data representations for CVSS metrics, scores and vector strings in JSON Schema and XML Schema Definition (XSD) representations. These can be used to store and transfer CVSS information in defined JSON and XML formats.
CVSS 度量、分数和向量字符串在 JSON Schema 和 XML Schema Definition（XSD）表示中的数据表示。这些可以用于在定义的 JSON 和 XML 格式中存储和传输 CVSS 信息。

Version History  版本历史

Date  日期 Ver Description  描述
2023-11-01 v1.0 Initial Publication  首次发表
2023-11-09 v1.1 Correct impact metric order Corrected reference to Section 2.5 of the User Guide
正确的指标顺序 正确引用用户指南第 2.5 节
2024-06-18 v1.2 Corrected None metric in Section 2.2.3 Table 7
修正了第 2.2.3 节表 7 中的 None 度量

  1. See [https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html]() for a description of the evil maid attack. ↩
    查看[https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html]()了解邪恶女仆攻击的描述。 ↩

  2. Eric M Hutchins, Michael J Cloppert, and Rohan M Amin. Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. Leading Issues in Information Warfare & Security Research, 1:80, 2011.
    埃里克·M·哈钦斯，迈克尔·J·克洛珀特，以及罗汉·M·阿敏。基于对手行动和入侵杀伤链分析驱动的智能计算机网络防御。信息战与安全研究前沿问题，第 1 卷，第 80 页，2011 年。
    https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf ↩

  3. Note that this mapping between quantitative and qualitative scores applies whether just the Base, or all of Base, Threat, and Environmental metric groups, are assessed. ↩
    请注意，这种定量与定性评分之间的映射，无论仅评估基础，还是评估基础、威胁和环境指标组中的所有指标，都适用。↩

  4. [https://en.wikipedia.org/wiki/Equivalence_class]() ↩
    [https://zh.wikipedia.org/wiki/等价类]()