# data[].attributes.body
- CVSS overview - WIND
- Metric Groups - Ahmad
- Process & Reports

# data[].attributes.body
The Common Vulnerability Scoring System (CVSS) captures the principal technical characteristics of software, hardware, and firmware vulnerabilities. Its outputs include numerical scores indicating the severity of a vulnerability relative to other vulnerabilities. CVSS is composed of three metric groups: Base, Temporal, and Environmental.

The benefits of CVSS include the provision of a standardized vendor and platform agnostic vulnerability scoring methodology. It is an open framework, providing transparency to the individual characteristics and methodology used to derive a score.

# data[].attributes.body
Base Metric Group - reflects the severity of a vulnerability according to its intrinsic characteristics which are constant over time and assumes the reasonable worst-case impact across different deployed environments.

Temporal Metric Group - adjust the Base severity of a vulnerability based on factors that change over time, such as the availability of exploit code

Environmental Metric Group - adjust the Base and Temporal severities to a specific computing environment.

# data[].attributes.body
- Uses a tool called CVSS v3.1 Calculator

- The calculator is like a questionnaire in which the choices are made that describe the vulnerability for each metric group.

- Later, a score is generated and numeric severity rating is displayed.

# data[].attributes.body
For some purposes, it is useful to have a textual representation of the numeric Base, Temporal and Environmental scores. All scores can be mapped to the qualitative ratings defined in the table above.

As an example, a CVSS Base Score of 4.0 has an associated severity rating of Medium. The use of these qualitative severity ratings is optional, and there is no requirement to include them when publishing CVSS scores. They are intended to help organizations properly assess and prioritize their vulnerability management processes.

- The higher the severity rating, the greater the potential impact of an exploit and the greater the urgency in addressing the vulnerability.

- Any vulnerability that exceeds 3.9 should be addressed.