Severity Rating and CVSS for Bug Bounty Hunters
CVSS is a shared language, not a slot machine. Programs use it — or a cousin of it — to sort queues and set bounties. Inflating every XSS to Critical burns trust faster than a wrong vector string.
Score the exploit path you proved, not the nightmare sequel you imagined at 2 a.m.
Start from impact you demonstrated
Ask four blunt questions:
- Whose data or action did you affect (self, another user, any tenant, platform-wide)?
- Did you need a victim click, an authenticated session, or nothing?
- Was the effect read, modify, or take over?
- How reliable was the path in your tests?
Self-XSS with a hard social-engineering chain is not the same as stored XSS in a support inbox viewed by staff. Same CWE family, different score. An IDOR that returns one non-sensitive preference flag is not an IDOR that dumps payroll CSVs.
Write the business sentence first: "Any logged-in member can read another workspace's API tokens." Then pick metrics that match that sentence. Working backwards from "I want Critical" is how reports get laughed out of triage.
Map carefully to the vector
For CVSS v3.1, hunters most often mis-set:
- Attack Vector: Network is common for web bugs; Physical is rare. Do not pick Local just because the payload runs in a browser.
- Privileges Required: None vs Low vs High should match the account you used. A bug needing a workspace admin is not PR:N.
- User Interaction: Required if a victim must open a link, accept an invite, or import a file.
- Scope: Changed when you break out of the security authority of the vulnerable component. Be ready to defend this one with a clear trust-boundary story.
- CIA impact: High confidentiality for bulk PII dump; Low for a single non-sensitive field you already owned.
Write the vector string in the report. Then write one sentence in plain English beside it. If those two disagree, fix the vector — not the English.
Temporal and environmental metrics rarely belong in hunter submissions unless the program asks. Stick to base score and narrative impact.
Program policy beats your calculator
Some targets cap severity for certain classes (abandoned subdomain takeover, login CSRF, rate-limit bypass on non-auth endpoints). Others publish their own tables that diverge from FIRST. Read them before arguing with a 9.8 from an online calculator.
If triage downgrades, ask which metric they changed. A productive reply is "I set UI:N because the JSON endpoint is fetched by an automated partner integration — here is the request with no browser." A bad reply is "Critical or I disclose."
When two reasonable vectors exist, show both and explain why you chose the higher or lower one. That honesty travels further than a single aggressive number.
When not to obsess
Duplicate races, weak tokens on out-of-scope hosts, and theoretical chains with missing links should stay honest. A clean Medium that pays beats a rejected Critical essay.
Also remember: some programs ignore CVSS and use P1–P4. Translate your impact into their rubric instead of pasting a vector they will not use.
Use CVSS as scaffolding. Let demonstrated blast radius do the talking.