A security analyst is investigating a vulnerability in a custom-built inventory management system. The vulnerability allows an unauthenticated user to bypass login and access sensitive data. Which of the following CVSS Base Metrics would most significantly contribute to a high score for this vulnerability?
- AUser Interaction (UI)
- BConfidentiality Impact (C)
- CScope (S)
- DAttack Vector (AV)
Show answer & explanationAnswer & explanation
Correct answer: B. Confidentiality Impact (C)
The scenario describes an 'unauthenticated user bypass[ing] login and access[ing] sensitive data'. This directly points to a severe impact on Confidentiality. A complete loss of confidentiality (C: High) would significantly raise the CVSS score. Attack Vector (AV) is likely Network (N) but less impactful than Confidentiality Impact in this specific scenario. User Interaction (UI) would be None (N) for an unauthenticated bypass, which contributes to a higher score. Scope (S) depends on whether the vulnerability allows access to resources beyond the authorization scope of the vulnerable component itself, which is not explicitly stated as 'changed'. However, the direct access to 'sensitive data' is a clear and high impact on Confidentiality.
Why the other options are wrong
- A. User Interaction (UI) would be 'None', which *increases* the score, but 'Confidentiality Impact' is the direct outcome described as severe.
- C. Scope (S) changing would increase the score further, but the primary impact described is on confidentiality, not necessarily a change in scope.
- D. Attack Vector (AV) would likely be 'Network', which contributes to a high score, but the *impact* is more directly related to the high score in this scenario.
CVSS Confidentiality Impact (C)
A CVSS Base Metric that measures the impact on the confidentiality of the information managed by the affected component. It assesses the degree to which information is disclosed to unauthorized individuals.
- Rated as None, Low, or High.
- High impact means total loss of confidentiality.
- Crucial for data breaches and unauthorized access vulnerabilities.
Memory trick: C.I.A. (Confidentiality, Integrity, Availability) are the impact stars.