At an MSSP, public exploit code appears for a bug whose published CVSS v3.1 base score has not changed. Which metric family is the one that moves with that new code?
Select an answer to reveal the explanation.
Short Explanation
The lock on the door did not change, but a working key just showed up in public. You still have the same base score, and the family that moves when exploit code appears is the temporal metrics. The trap is retuning the customer's environment, or rewriting attack vector or user interaction.
Full Explanation
CVSS v3.1 keeps exploit-code maturity, remediation level, and report confidence in the temporal metrics, outside the base score. Public exploit code for an unchanged base score moves Temporal metrics, the family that tracks exploit-code maturity as public code appears. Environmental metrics, the family adjusted for this customer's security requirements and controls, change when that customer rescores for its own environment, not merely because exploit code was published. Attack vector, the base metric for whether the bug is reached remotely or only locally, is part of the base score and does not move just because a proof of concept exists. User interaction, the base metric for whether a person must act before the bug can run, is also a base metric and stays as published unless the vulnerability itself changed. Exam caveat: do not invent a numeric delta; the point is which family moves, and the published base score stays the base score. Operational check: compare the base vector with the temporal values on the advisory and confirm that exploit-code maturity is the value that changed.