At a retailer, a store-portal flaw does nothing until a clerk clicks a link in a message. Which CVSS v3.1 base metric records that a person must act before the flaw can run?
Select an answer to reveal the explanation.
Short Explanation
A door that stays shut until you turn the handle is the same idea as a flaw that sits still until a clerk clicks. You want the CVSS v3.1 base metric that records that required human action. The trap is treating the click as a timing race, an admin token, or a scope escape.
Full Explanation
CVSS v3.1 marks user interaction Required when the vulnerable component does nothing until a person takes an action such as opening a link. The retailer portal matches User interaction, the base metric for a flaw that stays idle until a person acts. Privileges required, the base metric for a flaw that needs an administrator token first, asks whether the attacker must already hold no authorization, low authorization, or high authorization, and a clerk click is not that token. Attack complexity, the base metric for a rare timing race the attacker must win first, rises when success depends on conditions outside the attacker's control, and a deliberate click is the person's action rather than a race. Scope changed, the base metric for impact that escapes the vulnerable component itself, applies only when impact crosses into another security authority, which this portal write-up does not claim. Exam caveat: a required click stays inside the base metrics and does not by itself rewrite privileges, complexity, or scope. Operational check: read the portal advisory's attack steps and confirm a person must open the link before any attacker-controlled code runs.