At a SaaS company, a flaw in a shared library lets an attacker change data outside the vulnerable component. Which CVSS v3.1 base metric names that escape?
Select an answer to reveal the explanation.
Short Explanation
You can picture a fire that starts in a shared closet and then burns the next room: its impact has left its original space. When a library flaw changes data beyond the vulnerable component, CVSS v3.1 calls that Scope. Keep that distinct from how you reach the flaw, exploit-code maturity, or an environmental adjustment for one customer’s data on this tenant.
Full Explanation
In CVSS v3.1, Scope is Changed when a vulnerability affects resources beyond the security authority of the vulnerable component. A shared-library flaw that changes data outside that component is Scope, the v3.1 base metric for impact that escapes the vulnerable component itself. Attack vector describes reaching the flaw over the network rather than locally; it concerns where the attacker must be, not whether impact leaves the component. Temporal exploit-code maturity changes as public exploit code appears and belongs to the temporal family, so it does not describe this escape. An environmental tweak that raises impact only for one customer’s data on this tenant is a customer-specific rescoring choice, not the base fact that the flaw crosses a component boundary. Exam caveat: CVSS v4.0 retired the Scope name and added Attack Requirements, so do not mix a v4 vector into this v3.1 question or invent a score. Practical check: read the library advisory for language showing that the impact reaches a component other than the library, and record that as a scope change on the v3.1 vector only.