# Helping CNAs Generate CVSS Scores Faster and More Confidently Using XAI
## Description
### Common Vulnerability Scoring System  
To assess the severity of cybersecurity vulnerabilities consistently, CNAs commonly utilize the Common Vulnerability Scoring System (CVSS), a standardized framework. The CVSS assigns a numerical score from 0 to 10 representing the severity of a vulnerability based on various metrics that measure its impact and exploitability. This system has been updated several times (see Appendix A), with the current one being version 4. In this paper, we focus on version 3.1, as it is the most commonly used version in the literature, allowing us to compare our results with previous studies. Therefore, we proceed with version 3.1 throughout the remainder of this paper. In this version, there are a total of 15 metrics that CNAs need to determine. These metrics are divided into three main groups:  
Figure 3: Example CVE (from the NVD website [18]). * Base Metric Group (B): This represents the intrinsic characteristics of a vulnerability that remain constant over time and across user environments. It further consists of two sets of metrics: exploitability metrics and impact metrics. * Exploitability metrics (BE): These reflect the ease and technical means by which the vulnerability can be exploited. They represent the characteristics of the vulnerable component. * Impact metrics (BI): These reflect the direct consequences of a successful exploit and represent the impact on the impacted component. * Temporal Metric Group (T): This reflects the characteristics of a vulnerability that may change over time but not across user environments. For example, the presence of a simple-to-use exploit kit would increase the CVSS score, while the creation of an official patch would decrease it. * Environmental Metric Group (E): This represents the characteristics of a vulnerability that are relevant and unique to a particular user's environment. Considerations include the presence of security controls that may mitigate some or all consequences of a successful attack and the relative importance of a vulnerable system within a technology infrastructure. Out of all these groups, the Base Metric Group (B) is the only one that is mandatory to generate, so we only focus on this group's metrics. These metrics, according to the MITRE specification document ([[https://www.first.org/cvss/specification-document](https://www.first.org/cvss/specification-document)]([https://www.first.org/cvss/specification-document](https://www.first.org/cvss/specification-document))) (accessed on 10 March 2024), are as follows:  
* Attack Vector (AV): This reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the Base Score) will be larger the more remote (logically and physically) an attacker can be to exploit the vulnerable component. * Scope (S): This captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope. * Attack Complexity (AC): This describes the conditions beyond the attacker's control that must exist to exploit the vulnerability. * Privileges Required (PR): This describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. The Base Score is greatest if no privileges are required. * User Interaction (UI): This captures the requirement for a human user other than the attacker to participate in the successful compromise of the vulnerable component. This metric determines whether the vulnerability can be exploited solely at the will of the attacker or whether a separate user (or user-initiated process) must participate in some manner. The Base Score is greatest when no user interaction is required. * Confidentiality Impact (CI): This measures the impact on the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.