Which elements may be considered when ranking vulnerabilities?

Which elements may be considered when ranking vulnerabilities?

• A. CVSS base score only.
• B. CVSS base score and vendor classification and type of systems affected.
• C. Type of systems affected only.
• D. None of the above.

Answer: (B)

Prioritizing vulnerabilities uses both a standardized severity measure and the real-world context in which the vulnerability exists. The CVSS base score gives a numeric sense of how severe a vulnerability is in isolation—how serious the potential impact could be and how exploitable the flaw appears. But risk in a live environment depends on more than just that score. Vendor classification and trends about exploitation provide insight into how actively the vulnerability is being targeted and how likely it is to be exploited in practice. The type of systems affected matters because the business impact varies dramatically depending on where the flaw exists; a vulnerability on payment processing or data-hosting systems carries a much higher risk than on less critical machines. So combining the CVSS base score with contextual factors like vendor classification and the specific systems affected yields the best ranking. Relying only on the base score ignores important context, and focusing only on the type of systems or claiming none of the above would miss the comprehensive view used in effective vulnerability management.

Prioritizing vulnerabilities uses both a standardized severity measure and the real-world context in which the vulnerability exists. The CVSS base score gives a numeric sense of how severe a vulnerability is in isolation—how serious the potential impact could be and how exploitable the flaw appears. But risk in a live environment depends on more than just that score. Vendor classification and trends about exploitation provide insight into how actively the vulnerability is being targeted and how likely it is to be exploited in practice. The type of systems affected matters because the business impact varies dramatically depending on where the flaw exists; a vulnerability on payment processing or data-hosting systems carries a much higher risk than on less critical machines.

So combining the CVSS base score with contextual factors like vendor classification and the specific systems affected yields the best ranking. Relying only on the base score ignores important context, and focusing only on the type of systems or claiming none of the above would miss the comprehensive view used in effective vulnerability management.