Learn CVSS vocabulary: base score, temporal score, environmental score, attack vector, attack complexity, privileges required, and reading CVE severity ratings.
0 / 10 completed
1 / 10
What does 'this CVE has a CVSS base score of 9.8' indicate?
CVSS (Common Vulnerability Scoring System) base scores range from 0.0 to 10.0. Severity ratings: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), Critical (9.0–10.0). A score of 9.8 is Critical — typically meaning Network attack vector, Low attack complexity, No privileges required, No user interaction. Example: CVE-2021-44228 (Log4Shell) received a CVSS 10.0.
2 / 10
What is the 'attack vector' metric in CVSS scoring?
Attack Vector (AV) reflects the component's exposure: Network (N) = exploitable remotely over the internet, highest impact on score. Adjacent (A) = requires being on the same network (Wi-Fi, Bluetooth). Local (L) = requires local system access (shell, RDP). Physical (P) = requires physical access to the device. Network AV vulnerabilities are most critical because they are exploitable by any attacker on the internet without physical proximity.
3 / 10
What does 'Privileges Required: None' mean in a CVSS score breakdown?
Privileges Required (PR) measures whether the attacker needs existing access: None (N) = no credentials or account needed — anonymous exploitation possible. Low (L) = needs basic authenticated access (standard user). High (H) = needs elevated or admin-level access. Combining AV:Network + PR:None produces the highest-scoring and most dangerous vulnerability class — exploitable by any unauthenticated attacker on the internet.
4 / 10
What is the 'temporal score' in CVSS, and how does it differ from the base score?
The CVSS temporal metric group modifies the base score based on: Exploit Code Maturity (is working exploit code publicly available?), Remediation Level (is a patch available?), and Report Confidence (how confirmed is the vulnerability?). A new unpatched vulnerability with a public exploit scores higher temporally than a patched one with only theoretical exploitability. Temporal scores can change daily as the threat landscape evolves.
5 / 10
What is the 'environmental score' in CVSS and when is it used?
The environmental metric group lets organisations adjust CVSS for their specific context. Example: a Network-vector vulnerability with a base score of 9.8 might have an environmental score of 5.0 for an organisation where the affected component is only accessible from their internal network (modifying the attack vector). Environmental scoring helps prioritise remediation — a Critical base score might be Medium risk for your organisation's specific deployment.
6 / 10
Code Review Comment: 'I'm seeing a CVSS score of 7.5 for this vulnerability. The impact is high because it could lead to complete server compromise, but the exploitability seems low – only authenticated users can trigger it.' What does the 'impact' component primarily reflect in this scoring?
The 'impact' component in CVSS focuses on the potential harm resulting from a successful attack. It measures the severity of the damage – think data loss, system disruption, or financial impact – rather than simply how easy it is to exploit. A high impact score indicates that even a moderately exploitable vulnerability could cause significant problems.
7 / 10
Slack Message: 'Hey team, just ran the CVSS scan on the new API endpoint. It's showing a critical score of 9.1 – specifically due to the ability to bypass authentication controls. We need to prioritize this.' What does the phrase 'bypass authentication controls' most directly relate to within the context of CVSS scoring?
Within CVSS, 'bypass authentication controls' refers to the attacker's capability to circumvent established security mechanisms. This is a key factor in determining the exploitability of a vulnerability, as it represents a significant reduction in the difficulty for an attacker to gain unauthorized access. It's distinct from issues like outdated cryptography or input validation.
8 / 10
PR Description: 'Applying patch v2.3.1 now. This resolves a critical vulnerability (CVE-2024-XXXX) with a CVSS score of 8.2. The base score reflects the potential for remote code execution if an attacker can successfully exploit the flaw.' What does the 'base score' of 8.2 primarily represent in this situation?
The 'base score' in CVSS is the core assessment of a vulnerability's inherent risk. It combines metrics like attack vector and complexity to provide a foundational severity rating – representing the potential impact *before* considering any mitigating factors like temporal or environmental scores. It doesn't directly reflect remediation efforts.
9 / 10
Standup Update: 'I've been investigating the reported vulnerability in our logging service. The CVSS score is currently 6.1 – primarily due to the requirement for network access to exploit it. We're working on reducing this.' What does a 'requirement for network access' signify within the CVSS attack vector metric?
Within CVSS's attack vector metric, 'requirement for network access' denotes how an attacker needs to interact with the target system to exploit the vulnerability. This means that the vulnerability is only exploitable when there's a network connection involved, making it less immediately accessible than vulnerabilities requiring local access.
10 / 10
API Response: The server returned the following CVSS score breakdown: Base Score: 7.2; Temporal Score: 0.5; Environmental Score: 1.0. What does a 'temporal score' of 0.5 indicate in this case?
The 'temporal score' in CVSS accounts for changes in the exploitability of a vulnerability over time. A value of 0.5 indicates that the exploitability will decrease as defenses are implemented (like patching) or if the attacker's ability to leverage the vulnerability diminishes – representing a decline in risk over time. It's a dynamic element, unlike the base score.
What will I learn from the "CVSS Scoring Vocabulary" exercise?
Learn CVSS vocabulary: base score, temporal score, environmental score, attack vector, attack complexity, privileges required, and reading CVE severity ratings.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Security Disclosure Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss security disclosure language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Security Disclosure Language exercises?
See the full Security Disclosure Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.