Documentation / Application Security

CVSS Scoring

CVSS Scoring

Prancer assigns a CVSS v3 base score to every application security finding so you can prioritise remediation against an industry-standard severity scale (0 = no impact, 10 = critical).

Before you start

What CVSS v3 measures

CVSS v3 combines:

  • Base metrics — intrinsic characteristics of the vulnerability (attack vector, complexity, privileges, user interaction, scope, CIA impact).
  • Temporal metrics — change over time (exploit maturity, patch availability).
  • Environmental metrics — adjustments for your specific environment.

You can compute or validate any score with the official NVD CVSS v3 calculator.

How Prancer reports CVSS

Each finding is enriched with cvss_score, cweid, and mitreId:

{
  "cweid": "CWE-829",
  "cvss_score": 6.1,
  "name": "Cross-Domain JavaScript Source File Inclusion",
  "mitreId": "T1170"
}

The score above (6.1, Medium) is derived from these base metrics:

| Metric | Value | Meaning |

| --- | --- | --- |

| Attack Vector (AV) | Network (N) | Exploitable over the network |

| Attack Complexity (AC) | Low (L) | Easy to perform |

| Privileges Required (PR) | None (N) | No prior privileges needed |

| User Interaction (UI) | Required (R) | Victim must take an action (e.g. click a link) |

| Scope (S) | Unchanged (U) | Impact stays within the vulnerable component |

| Confidentiality (C) | Low (L) | Slight data exposure |

| Integrity (I) | Low (L) | Slight data tampering |

| Availability (A) | None (N) | No impact on availability |

Field reference

| Field | Description |

| --- | --- |

| cweid | Common Weakness Enumeration ID — categorises the underlying weakness (e.g. CWE-829 = Inclusion of Functionality from Untrusted Control Sphere). |

| cvss_score | CVSS v3 base score (0–10). Higher = more severe. |

| mitreId | MITRE ATT&CK technique that maps to the attack. |

Tip: CVSS gives you the raw severity. Combine it with risk profile, exposure (internet-facing vs internal), and compensating controls to set true business priority.

Where to see scores in the UI

CVSS scores appear next to each severity badge on the Application Security Findings page:

!MITRE Home

Next steps