CVSS Finding Write-up Generator

About this tool

A good vulnerability report states the severity, shows how to reproduce the problem, explains the impact and tells the reader how to fix it. This tool assembles that report from your notes and a CVSS vector. Paste a CVSS 3.1 or 3.0 vector (the CVSS calculator on this site builds one from choices) and the tool works out the score and rating, with temporal and environmental metrics if you included them. It writes a title, a small table (severity, vector, affected asset, linked CVE and CWE ids, who reported it and when), your summary and description, your steps to reproduce as a numbered list, an impact section, a breakdown of the CVSS metrics, your remediation advice and your references. The impact section is written for you from the vector (for example "An attacker can exploit this over the network with low complexity. It requires no privileges and no user interaction. It has a high impact on confidentiality...") unless you type your own. The breakdown explains every metric you chose in plain words, following the FIRST specification, so a reader who does not know CVSS can see why the score is what it is. Choose Markdown (for GitHub, GitLab, bug-bounty platforms and wikis) or plain text for email. By default what you type in the boxes is treated as plain text and escaped, so characters like # or * or a pasted < cannot turn into headings, formatting or HTML in the report; tick the box if you are writing Markdown yourself. Web addresses you type become links when the report is shown. The CVSS maths is the same code as the CVSS calculator, which is checked against real NVD scores and the reference Python cvss library; for this tool we also compared the score and rating of 400 random vectors with that library, confirmed that every metric value has its own explanation, and parsed the generated Markdown with a real Markdown parser to prove that hostile text in any field cannot add headings, code, images, HTML or script links or break the table (including with unusual line breaks such as a bare carriage return or a Unicode line separator). The tool only checks that the vector is valid, not that its metrics describe your finding: review them before you send the report. It supports CVSS 3.0 and 3.1 (not 4.0). Everything is written in your browser and nothing is uploaded.

How to use it

1. Enter the title and your CVSS vector (or open the CVSS calculator to build one).
2. Fill in the asset, description, steps, remediation and references.
3. Choose Markdown or plain text.
4. Copy the report or download it as a file.

Example

Shortened: the report also has your description, steps, the metric breakdown, remediation and references.

Reflected XSS in search · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · CWE-79

# Reflected XSS in search

| | |
|---|---|
| **Severity** | Medium (6.1, base score) |
| **CVSS** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` |
| **CWE** | [CWE-79](https://cwe.mitre.org/data/definitions/79.html) |

## Impact

An attacker can exploit this over the network with low complexity. It requires no privileges, and a user has to take some action. It has a limited impact on confidentiality and a limited impact on integrity, and the impact extends beyond the vulnerable component into other resources.

Common problems

It says my vector is not valid

Use the full form with the prefix, for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with every base metric once. CVSS 4.0 vectors are not supported.

My formatting shows as backslashes

By default your text is escaped so it stays plain. Tick the box that says you are writing Markdown if you want headings, lists and code in the boxes.

The score differs from the vendor or NVD

The score comes only from the metrics in the vector. A different vector, version (3.0 or 3.1) or the inclusion of temporal and environmental metrics gives a different number.