thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

CVSS Base Metrics

CVSS metrics describing a vulnerability's intrinsic exploitability and impact characteristics.

Definition

In CVSS 3.1, exploitability metrics are Attack Vector (Network, Adjacent, Local, Physical), Attack Complexity (Low, High), Privileges Required (None, Low, High) and User Interaction (None, Required), plus Scope (Unchanged, Changed). Impact metrics are Confidentiality, Integrity and Availability (High, Low, None).

Example

AV:N/PR:N/UI:N means remotely exploitable without credentials or user interaction - the most dangerous combination.

Exam tip

CySA+ commonly shows a vector string and asks which vulnerability to fix first; look for AV:N, PR:N, UI:N.

Related terms