At a bank, one write-up says a bug can be triggered from the internet, and another says the same bug can be triggered only from a local login on the host. Which CVSS v3.1 base metric changed?
Select an answer to reveal the explanation.
Short Explanation
The change is which road leads to the building, not which key you hold. You mark attack vector because one write-up is remote and the other is local. The trap is scoring a click, an admin account, or the bank's own uptime preference.
Full Explanation
In CVSS v3.1 the attack vector base metric describes where the attacker must be to reach the vulnerable component. Network means the bug is reachable across the network, including from the internet, and local means the attacker must already be on the host, such as through a local login. The two write-ups differ on that path and are silent on clicks and on account power, so the metric that changed is attack vector. The matching choice is "Attack vector, the base metric for reaching the bug over the network versus only on the host". "User interaction, the base metric for whether a person must take an action before the bug runs" would change if one write-up required a click or an opened file, and neither write-up says that. "Privileges required, the base metric for how strong an account the attacker must already hold" would change if one write-up needed an admin and the other needed no account, which is not the contrast given. "An environmental metric this bank sets from its own uptime needs and asset criticality" is the bank's own weighting of impact, and it is not a base metric that flips between two descriptions of the same bug's path. Exam caveat: keep v3.1 names, including attack vector, and do not replace this path metric with a v4 field or with an environmental requirement. Operational check: read both write-ups side by side and mark network versus local only where the text changes the attacker's location, leaving privileges and user interaction as stated.