CVSS: Common Vulnerability Scoring System

Metric groups: Base is split into Exploitability (Attack Vector, Attack Complexity, the new Attack Requirements, Privileges Required, User Interaction) and two separate Impact groups, Vulnerable System (VC/VI/VA) and Subsequent System (SC/SI/SA), replacing Scope. Threat (Exploit Maturity only, replacing the old Temporal group's 3 metrics). Environmental (Security Requirements plus modified versions of every Base metric). Supplemental metrics (Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort, Provider Urgency) are new, informational, and never change the numeric score.

The biggest change since v2.0 to v3.0. Scope is gone, replaced by scoring impact to the vulnerable system and any subsequent system separately. A new Attack Requirements (AT) metric captures preconditions beyond privileges and interaction. User Interaction gains Passive and Active values instead of just None/Required. New naming makes it explicit which metric groups were actually scored: CVSS-B (Base only), CVSS-BT (Base + Threat), CVSS-BTE (Base + Threat + Environmental) - so a bare score can no longer be mistaken for one that accounted for real-world exploit activity or organizational context.

Metric groups: Identical metric groups and metrics to v3.0: no new or removed metrics.

A clarification release, not a scoring redesign. It defines an explicit, integer-safe Roundup algorithm (Appendix A) to eliminate floating-point edge cases in the v3.0 rounding rule, and rewrites ambiguous metric definitions (particularly Scope and Privileges Required) for consistency across vendors. A given vector scores the same in v3.0 and v3.1 except in the rare cases where v3.0's rounding was ambiguous.

Metric groups: Base (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and Confidentiality/Integrity/Availability impact), Temporal (Exploit Code Maturity, Remediation Level, Report Confidence), and Environmental (Security Requirements plus modified Base metrics).

A major rework of v2.0: replaced Authentication with Privileges Required, added User Interaction and the Scope metric (whether the impact extends beyond the vulnerable component), and moved to the 5-band severity scale (None through Critical) that NVD and most vendors still use today.

Metric groups: Base (Access Vector, Access Complexity, Authentication, and Confidentiality/Integrity/Availability impact), Temporal (Exploitability, Remediation Level, Report Confidence), and Environmental (Collateral Damage Potential, Target Distribution, and security-requirement weights).

The original FIRST specification. Scored on a 3-band qualitative scale (Low, Medium, High) rather than the 5-band scale later versions use, had no concept of Scope, and its Authentication metric counted how many times an attacker had to authenticate rather than what privilege level was required. Largely superseded, but still seen in older CVE records and some legacy vulnerability tools.