Lion Cipher Lab
Score a vulnerability with CVSS v4.0 — and see why it moved from v3.1
- Threat Intel Analyst
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Every vulnerability you will ever triage arrives wearing a number: 'CVSS 9.8', 'critical', 'you must patch this now'. That number is the Common Vulnerability Scoring System, and almost everyone only ever CONSUMES it — they read whatever NVD or the vendor printed and treat it as gospel. That is a mistake in two directions. First, the number is a MODEL with inputs you can and should check: an advisory's own CVSS vector can be wrong, incomplete, or scored for a generic deployment that looks nothing like yours, and you cannot see any of that unless you can read and rebuild the vector yourself.…
What you'll learn
- explaining in plain words what CVSS is, what a vector string is, and the four metric groups (Base, Threat, Environmental, Supplemental) and which of them actually change the number
- building a valid CVSS:4.0 Base vector from an advisory: Attack Vector, Attack Complexity, the NEW Attack Requirements, Privileges Required, User Interaction, and the split Vulnerable-System (VC/VI/VA) vs Subsequent-System (SC/SI/SA) impact metrics
- computing a Base score for a real CVE in the free, offline FIRST v4.0 calculator, and reproducing the same result from the specification by hand
- scoring the SAME CVE under CVSS v3.1 and reading, concretely, what v4.0 changed: Attack Requirements, Subsequent-System impact, the removal of Scope, User Interaction split into Passive/Active, and the new Safety idea
- showing why a race-condition bug (Dirty COW) that v3.1 could only fudge as high complexity gets an honest Attack Requirements: Present in v4.0
- moving a score Base -> Threat by applying Exploit Maturity, and understanding that the Base score already assumes worst-case exploitation, so Threat can only LOWER it
- moving a score Base -> Environmental with Confidentiality Requirement and Modified metrics to reflect YOUR deployment, so the same CVE is scored differently for different assets
- stating the honest limit out loud: a Base score is SEVERITY, not risk or priority; it must be combined with known-exploited (KEV), exploit-probability (EPSS) and a decision framework (SSVC) before it drives what you patch first
Steps in this lab
- From zero: what CVSS is, what a vector string is, and the four metric groups
- Get the tools: the free client-side calculator, or the spec and a pen — and pick your CVEs
- The Base metrics, one at a time — including what is NEW in v4.0
- Worked example: build the CVSS:4.0 Base vector for Heartbleed (CVE-2014-0160)
- Score the SAME CVEs under v3.1 — and see exactly what v4.0 changed
- Move the score: Base -> Threat (Exploit Maturity) -> Environmental
- The honest limit: a Base score is SEVERITY, not risk or priority
- Judgment: how a professional actually uses the number