Two CVEs have similar base CVSS scores: one affects the city's public permitting site and one affects an offline label printer in a locked basement. How should the vulnerability team prioritize remediation?
Select an answer to reveal the explanation.
Short Explanation
Same score on paper does not mean same fire drill—a public website CVE is exposed to the world, while a basement printer is not. Blend CVSS with exposure and mission impact so the permitting site jumps the queue.
Full Explanation
CVE identifiers and CVSS scores provide a standardized severity baseline, but environmental factors such as internet exposure, asset criticality, and exploitability adjust true priority. A public-facing municipal application generally warrants faster remediation than an isolated internal printer with similar base scores. Treating scores as the sole equalizer without context misallocates limited patch windows.