How is confidentiality defined in the CVSS v3.0 framework?

This choice incorrectly references a person instead of a software component and describes an unsuccessful exploit, whereas CVSS measures impact from successful exploitation.

This choice incorrectly attributes the confidentiality impact to a person rather than a software component, which is not consistent with CVSS v3.0 terminology.

CVSS v3.0 scopes its metrics around software components, not people, because the scoring system is designed to measure the technical impact on the vulnerable software and any components it manages. Confidentiality is therefore measured as the impact on information resources managed by a software component resulting from a successful exploit. Using 'software component' is the precise CVSS v3.0 terminology that distinguishes it from broader or human-centric definitions.

This choice correctly references a software component but incorrectly describes an unsuccessful exploit, whereas CVSS v3.0 confidentiality impact is defined in terms of successful exploitation.