in the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?

3.0-6.9 is incorrect because scores from 3.0 to 3.9 fall within the Low severity band, not Medium.

40-6.0 is not a valid numeric range in CVSS scoring and appears to be a typographical error that does not match any defined band.

The official CVSS v3.1 specification defines Medium severity as any score in the range 4.0-6.9. The five bands are None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). A score of 4.0 is the lowest value that exits the Low band and enters Medium.

3.9-6.9 is incorrect because 3.9 is the upper boundary of the Low severity band, so the Medium range does not begin until 4.0.