312-50V11 · Question #858
in the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?
The correct answer is C. 4.0-6.9. CVSS v3.1 defines the Medium severity band as scores ranging from 4.0 to 6.9, with Low covering 0.1-3.9 and High covering 7.0-8.9.
Question
in the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?
Exhibit
Options
- A3.0-6.9
- B40-6.0
- C4.0-6.9
- D3.9-6.9
How the community answered
(21 responses)- C95% (20)
- D5% (1)
Why each option
CVSS v3.1 defines the Medium severity band as scores ranging from 4.0 to 6.9, with Low covering 0.1-3.9 and High covering 7.0-8.9.
The range 3.0-6.9 incorrectly overlaps with the Low severity band (0.1-3.9), making it inaccurate per the CVSS v3.1 specification.
The range 40-6.0 contains a typographical error and does not correspond to any valid CVSS v3.1 severity band.
The official CVSS v3.1 specification published by FIRST defines five severity ratings: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). The range 4.0-6.9 is the precise and complete Medium band as defined in the standard.
The range 3.9-6.9 incorrectly includes 3.9, which falls within the Low severity band, not Medium.
Concept tested: CVSS v3.1 severity rating score ranges
Source: https://www.first.org/cvss/v3.1/specification-document
Topics
Community Discussion
No community discussion yet for this question.