Learn to communicate CVSS vulnerability scores: base metrics, exploitability, impact, and temporal modifiers.
0 / 10 completed
1 / 10
What does CVSS stand for and what is it used for?
CVSS (Common Vulnerability Scoring System) is an open standard maintained by FIRST.org. It provides a standardized method for rating vulnerability severity using quantifiable metrics — enabling consistent prioritization across organizations and tools.
2 / 10
What are the three metric groups in CVSS v3?
CVSS v3 has three metric groups: Base (intrinsic severity — exploitability and impact metrics), Temporal (factors that change over time — e.g., exploit code availability), and Environmental (organization-specific adjustments — e.g., if the vulnerable system is critical to that business).
3 / 10
What does 'Attack Vector: Network' mean in CVSS notation?
CVSS Attack Vector: Network (AV:N) means the vulnerability is remotely exploitable over the internet — the highest-risk AV value. Other values: Adjacent (AV:A — same network), Local (AV:L — local access), Physical (AV:P — physical device access required).
4 / 10
What is 'Privileges Required: None' (PR:N) in CVSS?
PR:N means no authentication is required to exploit the vulnerability — it is accessible to unauthenticated attackers. Combined with AV:N (Network), PR:N vulnerabilities like unauthenticated RCEs receive Critical scores (9.8–10.0).
5 / 10
What is the 'Scope: Changed' (S:C) metric in CVSS v3?
Scope: Changed (S:C) means the vulnerability's impact extends beyond its authorization scope to other components. Classic example: a hypervisor escape (guest VM → host) or container escape. S:C typically increases the CVSS score significantly.
6 / 10
Sarah from Security just commented on your PR: 'The vulnerability score is a 7.8 based on the Network vector and high privilege requirements. It seems like you missed explicitly stating that this exploit could affect other systems.' What does Sarah likely mean by 'high privilege requirements' in the context of the CVSS score?
Sarah is highlighting that 'Privileges Required' (PR) in CVSS dictates who can exploit the vulnerability. A 'high' PR value (typically 8 or above) means an attacker needs significant system-level access to trigger the vulnerability—effectively limiting its scope and potential impact. The incorrect options misinterpret this as a general severity level, rather than a specific requirement for successful exploitation.
7 / 10
You're writing the description for a new PR that fixes a potential SQL injection vulnerability. The API response from the scanner suggests 'Attack Vector: Adjacent'. What does this typically indicate about how an attacker could exploit this flaw?
'Attack Vector: Adjacent' signifies a common attack pattern where an attacker controls a component *adjacent* to the vulnerable application. This often involves user input or data passed between systems – like a web form submitting malicious SQL code directly into the database. The other options present incorrect interpretations of Attack Vectors, focusing on network access or full system compromise.
8 / 10
During a standup meeting, your team lead asks: 'What's the difference between Scope: Unchanged (S:U) and Scope: Changed (S:C) in CVSS?' You respond saying that they both determine the potential impact of an exploit. Which statement best describes the core distinction?
Sarah is highlighting that Scope defines whether a successful exploit can 'escalate' or propagate beyond the initially vulnerable component. S:U (Unchanged) means the vulnerability's impact remains limited to the system where it was found; S:C (Changed) indicates an attacker could potentially move laterally across the network, impacting other systems – this is a key difference in potential damage.
9 / 10
David, a senior developer, flags your code with a comment: 'This function has a CVSS score of 6.1 based on Network and Privileges Required. I'm concerned about the potential impact if this vulnerability were to be exploited.' What is David most likely trying to convey?
David's comment emphasizes that a CVSS score isn't just a number; it represents a combined assessment of risk. A score of 6.1 with Network and Privileges Required both above 5 indicates a considerable level of potential impact – the combination is what drives concern regarding exploitation.
10 / 10
You are reviewing a PR that includes a fix for a remote code execution vulnerability. The scanner's output shows 'Impact: Full'. What does this primarily indicate about the potential consequences of a successful exploit?
Impact: Full signifies the most severe consequence – complete system takeover. This means an attacker could execute arbitrary code with elevated privileges, leading to significant damage like data breaches, malware installation, or complete control of the affected server. The other options represent more limited impacts.
What will I practise in "CVSS Scoring — Vocabulary and Communication"?
This module focuses on Pentest Communication — real workplace phrasing you'll use on the job. It contains 10 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 10 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Pentest Communication exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around pentest communication — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Pentest Communication exercises?
See the Pentest Communication hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.