CS0-003 · Question #363
An analyst reviews a recent government alert on new zero-day threats and finds the following CVE metrics for the most critical of the vulnerabilities…
The correct answer is A. E:U. The question asks to identify the exploit code maturity from a given CVSS vector string, where 'E' represents Exploit Maturity.
Question
An analyst reviews a recent government alert on new zero-day threats and finds the following CVE metrics for the most critical of the vulnerabilities:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:W/RC:R Which of the following represents the exploit code maturity of this critical vulnerability?
Options
- AE:U
- BS:C
- CRC:R
- DAV:N
- EAC:L
How the community answered
(30 responses)- A93% (28)
- D3% (1)
- E3% (1)
Why each option
The question asks to identify the exploit code maturity from a given CVSS vector string, where 'E' represents Exploit Maturity.
In a CVSS vector string, the "E" metric stands for "Exploit Maturity" (or Exploitability). The value "U" for "E:U" signifies "Unproven," meaning there is no known exploit code or proof-of-concept available, indicating a low exploit maturity.
"S:C" represents "Scope: Changed" and is part of the Base Metrics, describing whether the vulnerability in one component impacts resources beyond its security scope.
"RC:R" represents "Report Confidence: Reasonable" and is part of the Environmental Metrics, indicating the confidence in the technical details of the vulnerability report.
"AV:N" represents "Attack Vector: Network" and is part of the Base Metrics, indicating that the vulnerability is exploitable remotely over a network.
"AC:L" represents "Attack Complexity: Low" and is part of the Base Metrics, indicating that a specialized access condition or mitigation is not required for a successful exploit.
Concept tested: Common Vulnerability Scoring System (CVSS) Exploit Maturity
Source: https://www.first.org/cvss/v3.1/specification-document
Topics
Community Discussion
No community discussion yet for this question.