CVSS Base Score: Exploitability Metrics

The four CVSS v3.1 Base metrics — Attack Vector, Attack Complexity, Privileges Required, User Interaction — that describe how a vulnerability is reached.

Why It Matters

Exploitability metrics answer "how hard is this to trigger," which is a different question from impact — a vulnerability can be catastrophic in effect and still score moderately if it requires local access and specific preconditions.

Application to Application Security

Attack Vector (Network/Adjacent/Local/Physical) is usually the metric that most changes a mobile finding's score — a network-reachable exported component scores very differently from a local, device-only issue requiring physical access.

Relation to Software Development

These metrics are what a CVSS calculator produces automatically once you answer four structured questions about a finding — engineers don't need to memorize the scoring, just understand what each answer implies about real-world reachability.

How Strata Surfaces This

Strata assigns a CVSS v3.1 Base Score automatically for every applicable finding, calculated from these standard metrics without manual input — visible on the finding detail view.

Developer guidance

When triaging a finding, read the Attack Vector and Privileges Required values first — they tell you fastest whether a finding is remotely reachable by an unauthenticated actor or requires conditions unlikely in your deployment.

Management guidance

A CVSS Base Score alone answers "how severe is this in the abstract," not "what should we fix first" — see EPSS and business context for that second question.

FIRSTCVSS v3.1 SpecificationSource ↗