Access Vector

---

Local (L) A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local (shell) account. Examples of locally exploitable vulnerabilities are peripheral attacks such as Firewire/USB DMA attacks, and local privilege escalations (e.g., sudo).

Adjacent Network (A) A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software. Examples of local networks include local IP subnet, Bluetooth, IEEE 802.11, and local Ethernet segment.

Network (N) A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed "remotely exploitable". An example of a network attack is an RPC buffer overflow.

Access Complexity

---

High (H) Specialized access conditions exist. For example: In most configurations, the attacking party must already have elevated privileges or spoof additional systems in addition to the attacking system (e.g., DNS hijacking). The attack depends on social engineering methods that would be easily detected by knowledgeable people. For example, the victim must perform several suspicious or atypical actions. The vulnerable configuration is seen very rarely in practice. If a race condition exists, the window is very narrow.

Medium (M) The access conditions are somewhat specialized; the following are examples: The attacking party is limited to a group of systems or users at some level of authorization, possibly untrusted. Some information must be gathered before a successful attack can be launched. The affected configuration is non-default, and is not commonly configured (e.g., a vulnerability present when a server performs user account authentication via a specific scheme, but not present for another authentication scheme). The attack requires a small amount of social engineering that might occasionally fool cautious users (e.g., phishing attacks that modify a web browser’s status bar to show a false link, having to be on someone’s “buddy” list before sending an IM exploit).

Low (L) Specialized access conditions or extenuating circumstances do not exist. The following are examples: The affected product typically requires access to a wide range of systems and users, possibly anonymous and untrusted (e.g., Internet-facing web or mail server). The affected configuration is default or ubiquitous. The attack can be performed manually and requires little skill or additional information gathering. The “race condition” is a lazy one (i.e., it is technically a race but easily winnable).

Authentication

---

Multiple (M) Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time. An example is an attacker authenticating to an operating system in addition to providing credentials to access an application hosted on that system.

Single (S) The vulnerability requires an attacker to be logged into the system (such as at a command line or via a desktop session or web interface).

None (N) Authentication is not required to exploit the vulnerability.

Confidentiality Impact

---

None (N) There is no impact to the confidentiality of the system.

Partial (P) There is considerable informational disclosure. Access to some system files is possible, but the attacker does not have control over what is obtained, or the scope of the loss is constrained. An example is a vulnerability that divulges only certain tables in a database.

Complete (C) There is total information disclosure, resulting in all system files being revealed. The attacker is able to read all of the system's data (memory, files, etc.)

Integrity Impact

---

None (N) There is no impact to the integrity of the system.

Partial (P) Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited. For example, system or application files may be overwritten or modified, but either the attacker has no control over which files are affected or the attacker can modify files within only a limited context or scope.

Complete (C) There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised. The attacker is able to modify any files on the target system.

Availability Impact

---

None (N) There is no impact to the availability of the system.

Partial (P)There is reduced performance or interruptions in resource availability. An example is a network-based flood attack that permits a limited number of successful connections to an Internet service.

Complete (C) There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.

Exploitability

---

Unproven (U) No exploit code is available, or an exploit is entirely theoretical.

Proof-of-Concept (POC) Proof-of-concept exploit code or an attack demonstration that is not practical for most systems is available. The code or technique is not functional in all situations and may require substantial modification by a skilled attacker.

Functional (F) Functional exploit code is available. The code works in most situations where the vulnerability exists.

High (H) Either the vulnerability is exploitable by functional mobile autonomous code, or no exploit is required (manual trigger) and details are widely available. The code works in every situation, or is actively being delivered via a mobile autonomous agent (such as a worm or virus).

Not Defined (ND) Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric.

Remediation Level

---

Official Fix (OF) A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.

Temporary Fix (TF) There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool, or workaround.

Workaround (W) There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate the vulnerability.

Unavailable (U) There is either no solution available or it is impossible to apply.

Not Defined (ND) Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric.

Report Confidence

---

Unconfirmed (UC) There is a single unconfirmed source or possibly multiple conflicting reports. There is little confidence in the validity of the reports. An example is a rumor that surfaces from the hacker underground.

Uncorroborated (UR) There are multiple non-official sources, possibly including independent security companies or research organizations. At this point there may be conflicting technical details or some other lingering ambiguity.

Confirmed (C) The vulnerability has been acknowledged by the vendor or author of the affected technology. The vulnerability may also be “Confirmed” when its existence is confirmed from an external event such as publication of functional or proof-of-concept exploit code or widespread exploitation.

Not Defined (ND) Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric.

Collateral Damage Potential

---

None (N) There is no potential for loss of life, physical assets, productivity or revenue.

Low (L) A successful exploit of this vulnerability may result in slight physical or property damage. Or, there may be a slight loss of revenue or productivity to the organization.

Low-Medium (LM) A successful exploit of this vulnerability may result in moderate physical or property damage. Or, there may be a moderate loss of revenue or productivity to the organization.

Medium-High (MH) A successful exploit of this vulnerability may result in significant physical or property damage or loss. Or, there may be a significant loss of revenue or productivity.

High (H) A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. Or, there may be a catastrophic loss of revenue or productivity.

Not Defined (ND) Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric.

Target Distribution

---

None (N) No target systems exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk.

Low (L) Targets exist inside the environment, but on a small scale. Between 1% - 25% of the total environment is at risk.

Medium (M) Targets exist inside the environment, but on a medium scale. Between 26% - 75% of the total environment is at risk.

High (H) Targets exist inside the environment on a considerable scale. Between 76% - 100% of the total environment is considered at risk.

Not Defined (ND) Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric.

Confidentiality Requirement

---

Low (L): Loss of confidentiality is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Medium (M): Loss of confidentiality is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

High (H): Loss of confidentiality is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Not Defined (ND): Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric.

Integrity Requirement

---

Low (L): Loss of integrity is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Medium (M): Loss of integrity is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

High (H): Loss of integrity is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Not Defined (ND): Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric.

Availability Requirement

---

Low (L): Loss of availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Medium (M): Loss of availability is likely to have a serious adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

High (H): Loss of availability is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization (e.g., employees, customers).

Not Defined (ND): Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric.