Security Vulnerability Report Form

Attack Vector (AV)

• Network (AV:N)
• Adjacent Network (AV:A)
• Local (AV:L)

Attack Complexity (AC)

• Low (AC:L)
• High (AC:H)

Privileges Required (PR)

• None (PR:N)
• Low (PR:L)
• High (PR:H)

User Interaction (UI)

• None (UI:N)
• Required (UI:R)

Scope (S)

• Unchanged (S:U)
• Changed (S:C)

Confidentiality Impact (C)

• None (C:N)
• Low (C:L)
• High (C:H)

Integrity Impact (I)

• None (I:N)
• Low (I:L)
• High (I:H)

Availability Impact (A)

• None (A:N)
• Low (A:L)
• High (A:H)

Exploit Code Maturity (E)

• Not Defined (E:X)
• Unproven that exploit exists (E:U)
• Proof of concept code (E:P)
• Functional exploit exists (E:F)
• High (E:H)

Remediation Level (RL)

• Not Defined (RL:X)
• Official fix (RL:O)
• Temporary fix (RL:T)
• Workaround (RL:W)
• Unavailable (RL:U)

Report Confidence (RC)

• Not Defined (RC:X)
• Unknown (RC:U)
• Reasonable (RC:R)
• Confirmed (RC:C)

Attack Vector (MAV)

• Not Defined (MAV:X)
• Network (MAV:N)
• Adjacent Network (MAX:A)

Attack Complexity (MAC)

• Not Defined (MAC:X)
• Low (MAC:L)
• High (MAC:H)

Privileges Required (MPR)

• Nof Defined (MPR:X)
• None (MPR:N)
• Low (MPR:L)
• High (MPR:H)

User Interaction (MUI)

• Not Defined (MUI:X)
• None (MUI:N)
• Required (MUI:R)

Scope (MS)

• Not Defined (MS:X)
• Unchanged (MS:U)
• Changed (MS:C)

Confidentiality Impact (MC)

• Not Defined (MC:X)
• None (MC:N)
• Low (MC:L)
• High (MC:H)

Integrity Impact (MI)

• Not Defined (MI:X)
• None (MI:N)
• Low (MI:L)
• High (MI:H)

Availability Impact (MA)

• Not Defined (MA:X)
• None (MA:N)
• Low (MA:L)
• High (MA:H)

Confidentiality Requirement (CR)

• Not Defined (CR:X)
• Low (CR:L)
• Medium (CR:M)
• High (CR:H)

Integrity Requirement (IR)

• Not Defined (IR:X)
• Low (IR:L)
• Medium (IR:M)
• High (IR:H)

Availability Requirement (AR)

• Not Defined (AR:X)
• Low (AR:L)
• Medium (AR:M)
• High (AR:H)