Which statement about CVSS metrics is correct?

• A. The CVSS scoring system uses Base, Temporal, and Environmental metrics.
• B. The CVSS scoring system uses Base, Temporal metrics only.
• C. The CVSS scoring system uses Environmental metrics only.
• D. The CVSS scoring system uses All four metrics: Base, Temporal, Environmental, and Accessibility.

Answer: (A)

CVSS scoring is built from three metric groups: Base, Temporal, and Environmental. The Base metrics measure the inherent severity of a vulnerability—how severe it would be if it were exploited—using factors like how the attacker could reach the target, the prerequisites required, and the potential impact on confidentiality, integrity, and availability. The Temporal metrics adjust that base score over time by considering how easily the vulnerability could be exploited in practice, the availability of remediation, and how confident researchers are about the information. The Environmental metrics tailor the score to a specific context, letting you account for how important the affected security properties are in a given environment and any modifications to the metric values that reflect that environment.

That’s why the statement is correct: CVSS uses these three groups, not four, and there isn’t a metric category called Accessibility. Stating that CVSS uses only two groups or only environmental metrics, or adding a non-existent fourth category, does not align with how the system is defined.