CVSS is now on its third major version (v3.1), which was designed to address some of the shortcomings in its predecessor, v2.
Most notably, version 3 introduces the looks at the privileges required to exploit a vulnerability, as well as the ability for an attacker to propagate across systems (“scope”) after exploiting a vulnerability.
Authors of CVSS v3 worked to introduce scoring changes that more accurately reflected the reality of vulnerabilities encountered in the wild. The three major metric groups – Base, Temporal, and Environmental each remained the same, but with changes within both the Base and the Environmental groups.
Recommended Reading: CVSS v2 vs CVSS v3