Question

During vulnerability triage, an analyst reviews a finding with the CVSS v3.1 base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Before escalating, the analyst wants to summarize the exploitation prerequisites to the change advisory board in plain language. Based solely on this vector string, which statement accurately describes how this vulnerability can be exploited?

Accepted Answer

It can be exploited remotely over the network with no privileges and no user interaction, and fully compromises confidentiality, integrity, and availability.

Answer

It requires the attacker to already possess low-level privileges on the target and to trick a user into clicking a link.

Answer

It requires local access to the host and high attack complexity, but changes the security scope beyond the vulnerable component.

Answer

It can be exploited over an adjacent network only, requires user interaction, and impacts availability alone.