Which CVSS metric represents vulnerabilities based on a particular environment or implementation?

Which CVSS metric represents vulnerabilities based on a particular environment or implementation?

• A. Base Metric
• B. Temporal Metric
• C. Environmental Metric
• D. Misconfiguration

Answer: (C)

The Environmental metric is about how the vulnerability behaves in a specific context. It accounts for environment-specific factors that can change the score depending on how and where the asset is deployed—things like the security requirements of the asset (how critical confidentiality, integrity, and availability are) and other deployment conditions that affect impact or exploitability. This makes the Environmental metric the one that best represents vulnerabilities tied to a particular environment or implementation. The base metric covers the inherent characteristics of the vulnerability itself, the temporal metric tracks changes over time (like exploit availability), and misconfiguration isn’t a CVSS metric. In short, environmental factors tailor the rating to the real-world context of the system.

The Environmental metric is about how the vulnerability behaves in a specific context. It accounts for environment-specific factors that can change the score depending on how and where the asset is deployed—things like the security requirements of the asset (how critical confidentiality, integrity, and availability are) and other deployment conditions that affect impact or exploitability. This makes the Environmental metric the one that best represents vulnerabilities tied to a particular environment or implementation.

The base metric covers the inherent characteristics of the vulnerability itself, the temporal metric tracks changes over time (like exploit availability), and misconfiguration isn’t a CVSS metric. In short, environmental factors tailor the rating to the real-world context of the system.