At a university, one bug can be exploited only by an already-logged-in admin, and another bug on the same kind of host needs no account at all. Which CVSS v3.1 metric differs between them?
Select an answer to reveal the explanation.
Short Explanation
One door needs the master key already in your hand, and the other needs no key. You score privileges required, admin versus none, for these two bugs. The trap is marking a click, the attacker's location, or how badly a lab outage would hurt the campus.
Full Explanation
CVSS v3.1 privileges required scores the access the attacker must already have before exploiting the bug. High fits an already-logged-in administrator, and none fits a bug that needs no account. The two university bugs differ on that point and not on a click or on where the attacker must stand. The metric is "Privileges required, the metric separating a bug that needs an already-logged-in admin from a bug that needs no account". "User interaction, the metric for whether a person must click before the bug can run at all" would differ if one bug waited on a person to click or open a file, and the contrast here is the account, not a click. "Attack vector, the metric for where the attacker must be standing to reach the vulnerable code" would differ if one bug were reachable from the network and the other only locally, which these descriptions do not say. "An environmental impact value this campus assigns from how badly a lab outage would hurt teaching" is the campus weighting of impact, and it is the same kind of host in both cases rather than a difference between the bugs. Exam caveat: an already-logged-in admin is privileges required, and it is not user interaction and not an environmental requirement. Operational check: for each write-up, record whether the attacker needs no account, a normal user, or an admin before you touch attack vector or user interaction.