A software application to analyze the effects of temporal and environmental metrics on overall CVSS v2 score

The Common Vulnerability Scoring System (CVSS) is an emerging standard for scoring the impact of vulnerabilities. The CVSS base score has been widely adopted by the industry as a framework for exchanging general vulnerability information, while CVSS temporal and environmental scores, which estimate the effect of vulnerabilities within specific environments, is yet to become part of routine IT risk assessment methodologies. To mitigate the effects of vulnerabilities in an environment, a large number of combinations of environmental metric group values can be manipulated. Due to the unavailability of an efficient CVSS tool, identification of the optimum combination for reducing the score to an acceptable level is a daunting task. This paper reports on a software application developed to help to mitigate the risks and study the effects of temporal and environmental metrics on the overall CVSS v2 score. The developed software solution will be released under the Creative Commons Attribution 3.0.