An Analysis of CVSS v2 Environmental Scoring

This paper analyses the effect of the environmental metrics on the CVSS v2, and it shows that the environmental metrics impact the CVSS base score values in more ways than can be gleaned from the CVSS calculator provided by the NVD. This paper also unveils unexpected anomalies of "negative" calculated results of the Overall CVSS score when the base score is subjected to the environmental metrics. It also reveals that base scores of equal values do not necessarily remain equal when subjected to the environmental metrics. The presented results are based on a theoretical analysis of tthe formulas used in the CVSS v2 calculations. An approach to calculating the Overall CVSS score that eliminates the occurrence of "negative" values, and keeps the values within the range (0.0 -- 10.0) as defined in the guide for scoring vulnerabilities in the CVSS v2 is also suggested in this paper.