It appears that the CVSS "Integrity" metric is "N" for None:
Even though this exploit provides read-only, it is unclear what remote files are accessible. At the very least, any passwords stored in PHP files are likely compromised.
Under Linux, you will want to verify which user is running PHP on behalf of the web server, and what permissions that user has.
The proof of concept in the vulnerability report tries to read
/etc/passwd which is a common root access check.
It would be unclear if you could trust server logs if root access was possible.