Cisco Certified Support Technician (CCST) CybersecurityVulnerability ManagementEasy
A cybersecurity analyst is evaluating a recently discovered vulnerability in a critical enterprise application. The vulnerability allows an unauthenticated attacker to bypass authentication mechanisms and gain administrative access. The application is publicly accessible and processes sensitive customer data. According to CVSS, which metric would primarily contribute to a 'High' score for the 'Confidentiality' impact?
- AAvailability Impact
- BAttack Complexity
- CIntegrity Impact
- DConfidentiality Impact
Show answer & explanationAnswer & explanation
Correct answer: D. Confidentiality Impact
The scenario explicitly states that an unauthenticated attacker can gain administrative access to an application processing sensitive customer data. This directly impacts the confidentiality of that data, as unauthorized disclosure is possible.
Why the other options are wrong
- A. Availability impact relates to the loss of access to the system or data, not unauthorized disclosure.
- B. Attack Complexity is an exploitability metric, not an impact metric, and describes how difficult it is to exploit the vulnerability.
- C. Integrity impact relates to the unauthorized modification or destruction of data, not unauthorized access to view it.
CVSS Confidentiality Impact
The CVSS Confidentiality Impact metric measures the impact on the confidentiality of the information managed by the vulnerable system if the vulnerability is exploited.
- Rated as None, Low, or High.
- High means there is a total loss of confidentiality, resulting in all resources within the impacted scope being divulged.
- Low means there is some loss of confidentiality, but information disclosure is limited.
Memory trick: CIA Triad helps remember CVSS impacts.