200-201 · Question #412
According to CVSS, what is the attack vector?
The correct answer is C. context by which vulnerability exploitation is achievable. According to CVSS (Common Vulnerability Scoring System), the attack vector refers to the context or means by which an attacker can exploit a vulnerability, such as physically, locally, adjacent to the network, or remotely.
Question
According to CVSS, what is the attack vector?
Options
- Aset of steps taken by a threat actor before exploiting the vulnerability
- Bprocess by which an attacker tries to exploit an existing vulnerability
- Ccontext by which vulnerability exploitation is achievable
- Dpractical demonstration of an attack to understand the required tools and resources
How the community answered
(22 responses)- B5% (1)
- C91% (20)
- D5% (1)
Why each option
According to CVSS (Common Vulnerability Scoring System), the attack vector refers to the context or means by which an attacker can exploit a vulnerability, such as physically, locally, adjacent to the network, or remotely.
This describes part of an attack chain or kill chain, not specifically the CVSS Attack Vector metric.
This describes the general process of exploitation, not the specific "context" as defined by CVSS's Attack Vector.
The CVSS metric "Attack Vector" (AV) specifically defines the access complexity required to exploit a vulnerability, indicating whether exploitation requires physical access, local access, access to an adjacent network, or can be achieved remotely over the network. It describes the reachability of the vulnerable component.
This describes a proof-of-concept or penetration test activity, not the CVSS Attack Vector definition.
Concept tested: CVSS Attack Vector definition
Source: https://www.first.org/cvss/v3.1/specification-document#Attack-Vector-AV
Topics
Community Discussion
No community discussion yet for this question.