A Study of CVSS v4.0: A CVE Scoring System

In the cyber world, almost all of the attacks that occur are due to the exploitation of some vulnerability of the system. Vulnerabilities have caused major harm to the growth and reputation of the organisations. Currently, MITRE assigns a unique number to each new vulnerability identified which is made available to the public via open-access databases. Further, each CVE is assigned a score known as the CVSS score based on its severity. CVSS is a commonly accepted industrial standard for scoring vulnerabilities published as CVEs. In this paper, an attempt is made to summarize the work done on CVSS. It is noticed that the researchers have proposed improvements to the CVSS scoring method and have analysed CVSS metrics. With fine-tuning, it can give better results in the prioritization process of faults and can be used as a severity measure in other systems as well.