Question
A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?
- A. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L Correct
- B. CVSS:3.1/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
- C. CVSS:3.1/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H
- D. CVSS:3.1/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H
Explanation
Option A is the only vector that combines Privileges Required: None (PR:N) and User Interaction: None (UI:N) with a network attack vector and a high confidentiality impact, which matches an actively exploited flaw that needs no user action or privilege escalation. Option B requires high privileges and user interaction, option C has no integrity impact and a high availability impact, and option D requires user interaction and has a high availability impact. Each of B, C and D contradicts the description on more than one metric, so A is the closest fit.
