flawopen.com/Severity explained

What does a CVSS score actually mean for my app?

Reference page — draft, pending review
Short answer

CVSS (Common Vulnerability Scoring System) turns a vulnerability's severity into a number from 0.0 to 10.0. The number alone doesn't tell you how urgent it is for your app — you need the pieces that make it up, not just the final digit.

The scale, in plain language

Why the number alone can mislead you

A 9.8 on a vulnerability in a library you don't actually use anywhere reachable by untrusted input is not urgent for you, whatever the number says. A 6.5 on something processing every incoming request with no authentication in front of it might matter more in practice than the number suggests. CVSS scores exploitability and technical impact in the abstract — not your specific deployment, your specific data sensitivity, or what's actually reachable from the internet in your setup.

The pieces that make up the score

Attack Vector — how does an attacker reach it?

Network-reachable (worst case) vs. requiring local access vs. requiring physical access. A network-reachable flaw scores higher because far more attackers can attempt it.

Privileges Required — does the attacker need to be logged in first?

"None" scores higher than "requires an authenticated account" — an unauthenticated flaw is exploitable by literally anyone who can reach the endpoint.

Impact — what can the attacker actually do?

Scored separately for confidentiality (can they read data they shouldn't), integrity (can they change data), and availability (can they take the system down). A vulnerability that hits all three scores much higher than one that only affects one.

FAQ

Should I always patch a 9.8 before a 6.5?

Usually, but check reachability first — an unreachable 9.8 in code your app never executes is lower real-world priority than a reachable 6.5 in your actual request path.

Is CVSS the only thing that should drive patch priority?

No — whether it's actively being exploited in the wild (check CISA's KEV catalog), whether it's reachable in your specific deployment, and what data is actually exposed all matter as much or more than the raw score.

References