CVSS

Base Metrics

1. Exploitability Metrics

1.1 Attack Vector (AV)

Code	Metric Value	Description	OSI model	Examples
AV:N	Network	Remote via layer3	Layer 3
AV:A	Adjacent Network	Shared physical/logical network	Layer2	Bluetooth or same VLAN
AV:L	Locally via read/write/execute permissions	None-related to network	local user account
AV:P	In-person touch	None-related to network	Attach an peripheral USB

1.2 Attack Complexity (AC)

Code	Metric Value	Description
AC:L	Low	No or non-special conditions required for a successful exploit.
AC:H	High	A successful exploit depends on special conditions and requires attackers' invest effect in preparation and execution.

1.3 Privileges Required (PR)

Code	Metric Value	Description
PR:N	None
PR:L	Low	Standard user
PR:H	High	Privilege user

1.4 User Interaction (UI)

Code	Metric Value	Description
UI:N	None	No interaction
UI:R	Require	Actions from a user

2. Scope (S)

Code	Metric Value	Description	Examples
S:U	Unchanged	Vulnerable component and impact component are the same	Control local host via a OS vulnerability.
S:C	Changed	Vulnerable component and impact component are different	Control the local host via an Apache vulnerability.

3. Impact Metrics

Confidentiality Impact (C)

Code	Metric Value	Description
C:N	None
C:L	Low	Some loss
C:H	High	Total loss

Integrity Impact (I)

Code	Metric Value	Description
I:N	None
I:L	Low	Modification of data is possible.
I:H	High	Attacker can modify all data; direct and serious damage.

Availability Impact (A)

Code	Metric Value	Description
I:N	None
I:L	Low	Reduced performance; Can't completely deny service all the time.
I:H	High	Service completely unavailable all the time; direct and serious damage.