CVSS Metrics

What does AV mean in CVSS

Attack Vector - How the attacker accesses the system (ex. Network, local, etc)

What does AC mean in CVSS

Attack Complexity - how hard is it to exploit the vulnerability

What does PR mean in CVSS

Privileges Required - The access level needed to exploit it

What does UI mean in CVSS

User Interaction - Does a user need to do something for it to work?

What does S mean in CVSS

Scope - Whether other systems outside the vulnerable ones are affected

What does C stand for in CVSS

Confidentiality

What does I stand for in CVSS

Integrity

What does A stand for in CVSS

Availability

What does AV:N mean?

Network-based attack (can be done remotely)

What does AC:L mean?

Low-complexity - its easy to exploit

What does PR:N mean?

No privileges needed - attacker doesn't need to be logged in

What does UI:N mean?

No user interaction required

What does S:U mean?

Scope unchanged - The attack stays within the same system boundary.

What does C:H mean?

High loss of confidentiality - sensitive data can be exposed

This CVSS value means no user interaction is needed

UI:N

A CVSS attack with PR:N means what?

The attacker doesn't need any privileges (not logged in)

Example of AV:N (Network Attack)

Remote code execution over HTTP/SMB

AV: N

N = Network - remote/external attacker (ex. Web Exploit)

AV: A

A = Adjacent - same subnet/Wi-Fi/LAN (ex. ARP spoof on the same network)

AV: L

L = Local - Physical or local OS access (ex. Needs shell/terminal access)

AV: P

P = Physical - touching the device (ex. USB-based attack)

AC (Attack Complexity): L or H

L = Low - Reliable, no special conditions (ex. Exploit always works.

H = High - needs timing or weird state (ex. Race condition, exact state needed)

PR (Privileges Required): N,L, or H

N = None - no login needed (ex. Public web server vulnerability)

L = Low - limited user access (ex. Logged-in non-admin)

H = High - admin/root needed (ex. Needs full control)

UI (User interaction): N,R

N = None - no user action needed (ex. Exploit runs automatically)

R = Required - user must do something (ex. Click a phishing link, open file)

S (Scope): U,C

U = Unchanged - same system targeted (ex. Same permissions/app scope)

C = Changed - Breaks isolation or affects other systems (ex. Breaks out of VM or container)

CIA (Confidentiality, Integrity, Availability): N,L, H

N = None - no data changed/exposed (ex. only crash happens, just viewing allowed, all continues to work)

L = Low - some info leaked/minor modification (ex. usernames, emails/changes logs, timestamps, slower responses)

H = High - sensitive/confidential data, serious data manipulation, total outage or DoS (Denial of Service) (ex. Passwords/PII, Changes in configs, system crash)