Understanding CVSS

The attack vector metric (AV)

describes how an attacker would exploit the vulnerability

The attack complexity metric (AC)

describes the difficulty of exploiting the vulnerability

The privileges required metric (PR)

describes the type of account access that an attacker would need to exploit a vulnerability

The user interaction metric (UI)

describes whether the attacker needs to involve another human in the attack

The confidentiality metric (C)

describes the type of information disclosure that might occur if an attacker successfully exploits the vulnerability

The integrity metric (I)

describes the type of information alteration that might occur if an attacker successfully exploits the vulnerability

The availability metric (A)

describes the type of disruption that might occur if an attacker successfully exploits the vulnerability

The scope metric (S)

describes whether the vulnerability can affect system components beyond the scope of the vulnerability. Not that the scope metric table does not contain score information. The value of the scope metric is reflected in the values for the privileges required metric