Comprehensive comparison between versions CVSS v2.0, CVSS v3.x and CVSS v4.0 as vulnerability severity measures

This paper, presents a comparative study for three versions of Common Vulnerability Scoring System (CVSS), CVSS v2.0, CVSS v3.x and newest CVSS v4.0. The focus is laid on new metrics added in CVSS v4.0, i.e. Threat Metrics, Impact Metrics exceeding Confidentiality (C), Integrity (I), and Availability (A), and optional Supplemental Metrics providing additional information regarding security, and automated approach towards environment assessment using assets databases. Concluded research showed a more defined approach in the newest standard, defining Base $(B)$, Threat $(T)$ and Environmental $(E)$ metrics components as part of the CVSS assessment. Python and NodeJs applications were developed to calculate the CVSS scores. The analysis is further supported by a qualitative study of selected vulnerabilities.