A security analyst is reviewing a vulnerability scan report that indicates a critical vulnerability with a CVSS base score of 9.8. The vulnerability affects an internal development server that is not accessible from the internet and contains no sensitive customer data. Which of the following CVSS metrics would most likely be adjusted to lower the overall risk score for this specific environment?
- AAttack Complexity (AC)
- BExploitability (E)
- CRemediation Level (RL)
- DConfidentiality Impact (C)
Show answer & explanationAnswer & explanation
Correct answer: C. Remediation Level (RL)
The Remediation Level (RL) metric in the CVSS Environmental Score is used to reflect the availability of a fix or workaround for a vulnerability. If a workaround exists or a fix is readily available, the RL can be set to 'Official Fix,' 'Temporary Fix,' or 'Workaround,' which can lower the overall environmental score. The other options are base or temporal metrics that are not directly adjusted to reflect environmental specifics like internal server access or data sensitivity.
Why the other options are wrong
- A. Attack Complexity (AC) is a base metric, not an environmental metric, and describes the difficulty of exploiting the vulnerability.
- B. Exploitability (E) is a temporal metric, but Remediation Level is more directly applicable to adjusting risk based on the availability of a fix.
- D. Confidentiality Impact (C) is a base metric, not an environmental metric, and describes the impact on confidentiality if the vulnerability is exploited.
CVSS Remediation Level
A CVSS Temporal Metric that measures the availability of a fix for a vulnerability. It influences the overall risk score by indicating how likely it is that an organization can mitigate the vulnerability.
- Part of CVSS Temporal Metrics.
- Reflects the maturity and availability of a fix or workaround.
- Can significantly lower the overall environmental score if a fix is readily available.
Memory trick: Environmental scores adapt the base, with Temporal and Environmental metrics making it truly local.