# Helping CNAs Generate CVSS Scores Faster and More Confidently Using XAI
## Appendix A Common Vulnerability Scoring System
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Metric** & **Possible Values** & **Value Description** \\ \hline \multirow{6}{*}{Explicit Code} & \multirow{2}{*}{Not Defined (X)} & \multirow{2}{*}{Assigning this value indicates there is insufficient information to choose one of the other values and has no impact on the overall Temporal Score, i.e., it has the same effect on scoring as assigning high.} \\ \cline{3-3}  & \multirow{2}{*}{High (H)} & Functional autonomous code exists, or no exploit is required (manual trigger) and details are widely available. Exploit code works in every situation or is actively being delivered via an autonomous agent (such as a worm or virus). \\ \cline{2-3}  & \multirow{2}{*}{Functional (F)} & Functional exploit code is available. The code works in most situations where the vulnerability exists. \\ \cline{3-3}  & \multirow{2}{*}{Proof of Concept (P)} & \multirow{2}{*}{Proof of concept (P)} & \multirow{2}{*}{Proof of concept (P)} \\  & & The code or technique is not functional in all situations and may require substantial modification by a skilled attacker. \\ \cline{2-3}  & \multirow{2}{*}{Unproven (U)} & No exploit code is available, or an exploit is theoretical. \\ \hline \multirow{6}{*}{Remediation Level (RL)} & \multirow{2}{*}{Not Defined (X)} & \multirow{2}{*}{Assigning this value indicates there is insufficient information to choose one of the other values and has no impact on the overall Temporal Score, i.e., it has the same effect on scoring as assigning unavailable.} \\ \cline{3-3}  & \multirow{2}{*}{Unavailable (U)} & There is either no solution available or it is impossible to apply. \\ \cline{3-3}  & \multirow{2}{*}{Workaround (W)} & There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate the vulnerability. \\ \cline{3-3}  & \multirow{2}{*}{Temporary Fix (T)} & There is an official but temporary fix available. This includes instances where the vendor issues a temporary hofix, tool, or workaround. \\ \cline{3-3}  & \multirow{2}{*}{Official Fix (O)} & A complete vendor solution is available. Either the vendor has issued an official patch or an upgrade is available. \\ \hline \multirow{6}{*}{Report Confidence (RC)} & \multirow{2}{*}{Not Defined (X)} & Assigning this value indicates there is insufficient information to choose one of the other values and has no impact on the overall Temporal Score, i.e., it has the same effect on scoring as assigning confirmed. \\ \cline{3-3}  & \multirow{2}{*}{Confirmed (C)} & Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). \\ \cline{3-3}  & \multirow{2}{*}{Confirmed (C)} & Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability. \\ \cline{3-3}  & \multirow{2}{*}{Reasonable (R)} & Significant details are published, but researchers either do not have full confidence in the root cause or do not have access to source code to fully confirm all of the interactions that may lead to the result. \\ \cline{3-3}  & \multirow{2}{*}{Unknown (U)} & There are reports of impacts that indicate a vulnerability is present. The reports indicate that the cause of the vulnerability is unknown, or reports may differ on the cause or impacts of the vulnerability. \\ \cline{3-3}  & \multirow{2}{*}{Non (U)} & \multirow{2}{*}{The impact of the vulnerability is not included in the model.} \\ \cline{3-3}  & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Possible values of CVSS Temporal metrics. Once these metrics have been identified, a numerical score ranging from 0 to 10 can be calculated based on equations developed by the MITRE Corporation (see Appendix A). * Base: The Base Score is calculated based on the Impact and Exploitability subscore equations:
* If (Impact subscore) \(\leq\) 0, then Base Score \(=\) 0.