GB/T 30279-2013

This standard specifies the elements of the grading of information system security vulnerabilities (referred to as vulnerabilities) and the levels of their harmfulness.
This standard is applicable to the assessment and determination of the harmfulness of information security vulnerabilities by information security vulnerability management organizations and information security vulnerability release agencies, and it is also suitable for organizations and institutions engaged in information security product production, technology research and development, system operation, and other related work to refer to in their work.