A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
The source introduces CVSS 3.1 as a standard for communicating vulnerability severity and then focuses on the Base Score metrics. The useful skill is not memorizing labels. It is explaining why each metric matches the exploitation conditions and the resulting effect on confidentiality, integrity, and availability.
| Metric | Question |
|---|---|
| Attack Vector | How is the vulnerability reached? |
| Attack Complexity | What conditions beyond the attacker's control must exist? |
| Privileges Required | What level of privilege is needed before exploitation? |
| User Interaction | Must another user take an action? |
| Scope | Does exploitation affect a component outside the vulnerable component's security authority? |
| Confidentiality | How much unauthorized information exposure results? |
| Integrity | How much unauthorized modification is possible? |
| Availability | How much service or resource availability is lost? |
A useful way to reason about a Base Score is to narrate the attack conditions first and the impact second. The source's examples repeatedly do this: identify how the attacker reaches the component, whether privileges or interaction are required, decide whether scope changes, then describe the confidentiality, integrity, and availability consequences.
For the Cisco ASA buffer overflow example, the source assigns Network attack vector, Low complexity, no privileges, no user interaction, unchanged scope, and High impact across all three CIA dimensions, producing a critical 9.8 example. The value is the rationale: the score is tied to a concrete exploitation story.
For the stored XSS example, the source assigns Network, Low complexity, High privileges, no user interaction, Changed scope, Low confidentiality and integrity, and no availability impact. That produces a medium 5.5 example. The comparison shows why vulnerability class alone does not determine severity.
The source explains Scope as whether successful exploitation can affect components beyond the vulnerable one or resources governed by a different security authority. That is a different question from how the attacker reaches the target. Keeping those questions separate prevents a common scoring mistake.
The source uses CVSS 3.1 Base Score concepts. This course preserves that framing rather than silently replacing it with another scoring model.
Attack Vector: [condition]Attack Complexity: [condition]Privileges Required: [condition]User Interaction: [condition]Scope: [unchanged / changed + rationale]Confidentiality: [none / low / high + evidence]Integrity: [none / low / high + evidence]Availability: [none / low / high + evidence]
Writing one sentence of rationale beside every metric is a strong review habit. If you cannot explain why a value is true from the evidence, the score is probably being guessed instead of reasoned.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.