CVSS Base Score: Exploitability Metrics
The four CVSS v3.1 Base metrics — Attack Vector, Attack Complexity, Privileges Required, User Interaction — that describe how a vulnerability is reached.
Why It Matters
Exploitability metrics answer "how hard is this to trigger," which is a different question from impact — a vulnerability can be catastrophic in effect and still score moderately if it requires local access and specific preconditions.
Application to Application Security
Attack Vector (Network/Adjacent/Local/Physical) is usually the metric that most changes a mobile finding's score — a network-reachable exported component scores very differently from a local, device-only issue requiring physical access.
Relation to Software Development
These metrics are what a CVSS calculator produces automatically once you answer four structured questions about a finding — engineers don't need to memorize the scoring, just understand what each answer implies about real-world reachability.
How Strata Surfaces This
Strata assigns a CVSS v3.1 Base Score automatically for every applicable finding, calculated from these standard metrics without manual input — visible on the finding detail view.
Developer guidance
When triaging a finding, read the Attack Vector and Privileges Required values first — they tell you fastest whether a finding is remotely reachable by an unauthenticated actor or requires conditions unlikely in your deployment.
Management guidance
A CVSS Base Score alone answers "how severe is this in the abstract," not "what should we fix first" — see EPSS and business context for that second question.