for those who is not very familiar with CVSS scoring mechanism, let's break it apart, and I will elaborate my doubt following every element:
- AV:N means Attack Vector is Network, this is clear;
- AC:L means Attack Complexity is Low, Don't think so. as it require attacker to forge a special certificate.
- PR:N means privilege is not required.
- UI:N means user(victim) interaction is uneeded.
- S:U means Scope is unchanged.
- C:H means Confidentiality Impact is high. no doubtedly.
- I:H means Integrity Impact is high. we can agree on that.
- A:H means Availability Impact is high. how is this the case? why would a successful attempt break the availability of application?
Do you think this vulnerability qualify for a Critical vulnerability?