CompTIA CySA+ (CS0-003)Vulnerability ManagementHard
An analyst reviews a CVSS v3.1 temporal vector string attached to a finding: `E:F/RL:O/RC:C`. What does the `RL:O` component indicate about the current remediation state of the vulnerability?
- ANo solution or fix is currently available from any source
- BOnly a temporary, unofficial fix has been published
- CThe vendor has released an official, permanent patch
- DA workaround exists but requires manual configuration changes
Show answer & explanationAnswer & explanation
Correct answer: C. The vendor has released an official, permanent patch
In the CVSS v3.1 Remediation Level (RL) temporal metric, 'O' stands for Official Fix, meaning the vendor has issued a complete, permanent patch or update. This lowers the temporal score because a definitive remediation path exists, unlike Temporary Fix, Workaround, or Unavailable states.
Why the other options are wrong
- A. Unavailable is represented by 'RL:U', which would raise (not lower) urgency.
- B. Temporary Fix is represented by 'RL:T', not 'RL:O'.
- D. Workaround is represented by 'RL:W', a manual mitigation rather than an official patch.
CVSS Remediation Level (RL)
A CVSS v3.1 Temporal metric indicating how mature and permanent the available fix for a vulnerability is, ranging from no fix to an official vendor patch.
- Values: Official Fix(O), Temporary Fix(T), Workaround(W), Unavailable(U), Not Defined(X)
- Official Fix (O) lowers temporal score the most
- Unavailable (U) keeps the score closest to the base score
Memory trick: Official patch is the gold standard cure; Unavailable means still sick