A vulnerability scan reports a flaw with a CVSS base score of 9.8 on a test web server and a flaw scored 5.3 on the payroll database. A manager concludes that the test web server must be the more valuable asset. What does the CVSS base score actually express?
Select an answer to reveal the explanation.
Short Explanation
Think of CVSS like the danger rating on a chemical label -- it tells you how nasty the stuff is, not how valuable the room it's sitting in. A 9.8 means the flaw is severe wherever it shows up. The trap is reading the score as a statement about your asset; it knows nothing about your payroll database.
Full Explanation
The Common Vulnerability Scoring System produces a score from 0.0 to 10.0 describing the technical severity of a vulnerability. The base metrics capture characteristics of the flaw itself, such as attack vector, attack complexity, privileges required, user interaction and the effect on confidentiality, integrity and availability. Because those characteristics are the same wherever the flaw appears, the base score is identical on a test server and on a production system. Reading the score as the asset's business value confuses severity with criticality; asset value comes from the organization's own inventory and business impact analysis, not from the scanner's CVSS calculation. A probability of exploitation within a fixed time window is a separate kind of prediction produced by other models; CVSS base metrics describe how severe exploitation would be, not how likely it is in the coming weeks. The count of affected hosts is an inventory statistic and is not part of the score at all. Exam caveat: environmental context can be layered on top of the base score, but the base score alone never reflects your asset values. Operational check: record base score, asset criticality and exposure as separate fields in the tracking system before deciding remediation order.