[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eArtifact Analysis evaluates and assigns severity levels to vulnerabilities based on factors like exploitability and impact.\u003c/p\u003e\n"],["\u003cp\u003eSeverity levels include Critical, High, Medium, and Low, providing a qualitative assessment of each vulnerability.\u003c/p\u003e\n"],["\u003cp\u003eEffective severity is determined by either the Linux distribution maintainer for OS packages or the GitHub Advisory Database for language packages, and it differs slightly from the severity levels.\u003c/p\u003e\n"],["\u003cp\u003eThe CVSS score, available in versions 2.0 and 3.1, provides a quantitative measure of vulnerability severity, complementing the qualitative severity levels.\u003c/p\u003e\n"]]],[],null,["# Severity levels in Artifact Analysis\n\nThis document describes how Artifact Analysis evaluates vulnerabilities and\nassigns severity levels.\n\nArtifact Analysis rates vulnerability severity using the following levels:\n\n- Critical\n- High\n- Medium\n- Low\n\nThese severity levels are qualitative labels that reflect factors such as\nexploitability, scope, impact, and maturity of the vulnerability. For example,\nif a vulnerability enables a remote user to access a system and run arbitrary\ncode without authentication or user interaction, that vulnerability\nwould be classified as `Critical`.\n\nTwo additional types of severity are associated with each vulnerability:\n\n- Effective severity - Depending on the vulnerability type:\n\n - OS packages - The severity level assigned by the Linux distribution maintainer. If these severity levels are unavailable, Artifact Analysis uses the severity value from the note provider, [(NVD)](https://nvd.nist.gov/vuln-metrics). If NVD's CVSS v2 rating is unavailable, Artifact Analysis uses the CVSS v3 rating from NVD.\n - Language packages - The [severity level](https://docs.github.com/en/graphql/reference/enums#securityadvisoryseverity) assigned by the GitHub Advisory Database, with a slight difference: *Moderate* is reported as *Medium*.\n- [CVSS score](https://www.first.org/cvss/v3.1/user-guide#Scoring-Guide) - The Common\n Vulnerability Scoring System score and associated severity level, with two\n scoring versions:\n\n - [CVSS 2.0](https://www.first.org/cvss/v2/guide) - Available when using the API, the Google Cloud CLI, and the GUI.\n - [CVSS 3.1](https://first.org/cvss/v3.1/user-guide) - Available when using the API and the gcloud CLI.\n\nWhat's next\n-----------\n\n- [Investigate vulnerabilities](/artifact-analysis/docs/investigate-vulnerabilities).\n- [Gate builds in your Cloud Build pipeline](/artifact-analysis/docs/ods-cloudbuild) based on vulnerability severity."]]
