Android and iOS

Applying CVSS v4.0 to mobile findings

OWASP, secure development and the evidence behind controls.

Standards and evidence1 min readEditorial methods

CVSS helps describe technical severity consistently. Product priority also depends on data value, reachability and business impact.

Evaluation approach

Define the vulnerability, attack conditions and consequences before selecting metrics. Explain each vector choice and how threat or environmental context is used. A score alone hides the reasoning.

Application example

Determine whether a local file exposes only the signed-in user's information, other users' data or authority to perform server operations. A modified device alone is not enough context for scoring.

Limits and considerations

Technical severity and commercial loss are not identical. Low-volume, high-value transaction risks may need separate business priority.

Checks and decisions

  • Publish the vector with the score
  • Document assumptions
  • Assess business impact separately

Resolve disagreements through attack prerequisites and evidence rather than debating the number in isolation.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.