CVSS Base Score: Impact Metrics
The three CVSS v3.1 Base impact metrics — Confidentiality, Integrity, Availability — that describe what happens if a vulnerability is successfully exploited.
Why It Matters
Impact metrics are what most people intuitively mean by "severity" — but a full CVSS score combines impact with exploitability, so two findings with identical impact can carry very different final scores.
Application to Application Security
Mobile findings involving credential or PII exposure typically score high on Confidentiality; findings that let an attacker tamper with app behavior (component hijacking) score high on Integrity; direct Availability impact is comparatively rare in mobile app findings.
Relation to Software Development
Understanding which impact dimension a finding affects clarifies the actual remediation goal — a Confidentiality finding needs an access or exposure fix, an Integrity finding needs a validation or tamper-resistance fix.
How Strata Surfaces This
Included as part of the automatically calculated CVSS v3.1 Base Score attached to every applicable finding, alongside the exploitability metrics.
Developer guidance
Match remediation to the affected impact dimension — don't default to "patch and rescan" without understanding whether the actual gap is exposure, tampering, or availability.
Management guidance
When reporting findings up, impact metrics translate more directly into business risk language (data exposure, data integrity, service disruption) than exploitability metrics do.