flawopen.com/Severity explained
What does a CVSS score actually mean for my app?
Think of a CVSS score like a hotel fire alarm or building evacuation rating: CVSS (Common Vulnerability Scoring System) turns a vulnerability's severity into a number from 0.0 to 10.0. The number alone doesn't tell you how urgent it is for your room or application — you need the pieces that make it up, not just the final digit.
The scale, in plain language
- 0.1–3.9Low — usually hard to exploit or has minimal impact even if exploited
- 4.0–6.9Medium — worth scheduling a fix, not usually a drop-everything situation
- 7.0–8.9High — exploitable with real impact; prioritize soon
- 9.0–10.0Critical — often remotely exploitable with no authentication required and full system impact; treat as urgent
Why the number alone can mislead you
A 9.8 on a vulnerability in a library you don't actually use anywhere reachable by untrusted input is not urgent for you, whatever the number says. A 6.5 on something processing every incoming request with no authentication in front of it might matter more in practice than the number suggests. CVSS scores exploitability and technical impact in the abstract — not your specific deployment, your specific data sensitivity, or what's actually reachable from the internet in your setup.
The pieces that make up the score
Network-reachable (worst case) vs. requiring local access vs. requiring physical access. A network-reachable flaw scores higher because far more attackers can attempt it.
"None" scores higher than "requires an authenticated account" — an unauthenticated flaw is exploitable by literally anyone who can reach the endpoint.
Scored separately for confidentiality (can they read data they shouldn't), integrity (can they change data), and availability (can they take the system down). A vulnerability that hits all three scores much higher than one that only affects one.
FAQ
Usually, but check reachability first — an unreachable 9.8 in code your app never executes is lower real-world priority than a reachable 6.5 in your actual request path.
No — whether it's actively being exploited in the wild (check CISA's KEV catalog), whether it's reachable in your specific deployment, and what data is actually exposed all matter as much or more than the raw score.