Sidequest Note · Claude Leviathan ·
通用漏洞评分系统 4.0 版计算器。
NVD 的 CVSS v4.0 计算器的简体中文版。全部 5 个指标组、32 项指标、116 个取值及其官方释义均已翻译；评分逻辑移植自 FIRST 的参考实现，并已在 304,976 个向量上与其逐一比对。向量字符串本身保持 ASCII 原样，因为它是规范的一部分。
A Simplified Chinese edition of the NVD CVSS v4.0 calculator. All five metric groups, 32 metrics, 116 values and their official definitions are translated. The scoring is ported from FIRST's reference implementation and checked against it across 304,976 vectors; the vector string stays ASCII, because it is normative.
Sidequest Notes solely represent the views of the authors, and do not necessarily reflect the views of MCNAIR as a whole.
译注 Translator's notes
为什么
CVSS v4.0 的规范文档有官方英文本，计算器有官方英文实现，但简体中文使用者手里通常只有一份术语各异的二手翻译。同一个 AT，有人译作“攻击要求”，有人译作“攻击前提”，评分会议上就要为此停下来对齐五分钟。这个页面把 FIRST 规范里的全部释义译成一套自洽的中文，并且让它们停留在做决定的地方——鼠标停在指标上就能读到。
Why
CVSS v4.0 has an official English specification and an official English calculator. Simplified Chinese readers generally have neither — just second-hand glossaries that disagree with each other. One team's AT is 攻击要求, another's is 攻击前提, and a scoring call stops for five minutes to reconcile them. This page translates every definition in the FIRST specification into one internally consistent set of terms, and keeps them where the decision is made: under the cursor.
两处术语选择
Subsequent System → 后继系统。常见的“后续系统”读起来像“下一个要建的系统”；规范说的是承接后果的那个系统，所以取“后继”。
Safety → 人身安全。CVSS v4.0 引入 Safety 专指对人的伤害，其取值直接引用 IEC 61508 的后果分级。译作“安全”会与页面上其余几十处 security 语义的“安全”混为一谈，因此保留“人身”二字。
Two terminology calls
Subsequent System → 后继系统. The common rendering 后续系统 reads as "the next system we build". The specification means the system that inherits the consequences, which is what 后继 says.
Safety → 人身安全. CVSS v4.0 added Safety specifically to mean harm to humans, and its values cite the IEC 61508 consequence categories directly. Translating it as plain 安全 would collide with the several dozen other places on this page where 安全 means security.
没有翻译的部分
指标缩写（AV、MSI、CR…）、取值字母（N、H、Clear…）和向量字符串保持原样。它们不是标签而是数据格式：CVSS:4.0/AV:N/AC:L/… 要能在此处与任何其他 CVSS 工具之间往返传递，本地化会直接破坏这一点。宏向量的六位数字同理。
What isn't translated
Metric abbreviations (AV, MSI, CR…), value letters (N, H, Clear…) and the vector string are left alone. They are a data format, not labels: CVSS:4.0/AV:N/AC:L/… has to round-trip between this page and every other CVSS tool, and localising it would break exactly that. The macro vector's six digits are the same story.
分数是否可信
可信，因为它不是重写的。查表、宏向量推导和插值全部照搬 FIRST 与 Red Hat 的参考实现，逐字未改；改动只有两处机械处理——包进一个 IIFE，以及把原实现遗漏声明的变量收进函数作用域。随附的核验脚本会重新抓取上游代码，穷举 11 项基础指标的全部 104,976 种组合，再对 32 项指标随机抽取 200,000 个向量，两侧分数必须完全一致。翻译可以商榷，分数不行。
Whether to trust the score
Yes, because it wasn't rewritten. The lookup table, the macro vector derivation and the interpolation are the FIRST/Red Hat reference implementation verbatim; the only edits are mechanical — an IIFE wrapper, and hoisting the identifiers upstream assigns without declaring. The verifier shipped alongside re-fetches upstream, sweeps all 104,976 combinations of the 11 Base metrics, then draws 200,000 random vectors across all 32, and requires the two sides to agree exactly. The translation is arguable. The arithmetic is not.
来源与许可
评分代码与英文释义来自 FIRST.ORG 官方计算器，版权归 FIRST.ORG, Inc.、Red Hat 及其贡献者所有，以 BSD 2-Clause 许可发布；许可声明保留在 engine.js 中。规范原文见 CVSS v4.0 Specification Document。中文译文由 MCNAIR 提供，非官方译本。
Source and licence
The scoring code and the English definitions come from the official FIRST.ORG calculator, copyright FIRST.ORG, Inc., Red Hat and contributors, released under BSD 2-Clause; the notice is retained in engine.js. The normative text is the CVSS v4.0 Specification Document. The Chinese is MCNAIR's and is not an official translation.