Skip to main content
4 of 4
Title
Sjoerd
  • 34.4k
  • 13
  • 87
  • 119

Why does the CVSS3 score increase when the confidentiality impact decreases?

Consider these two cases:

  1. Impact on Confidentiality as High
  2. Impact on Confidentiality as Low
    Please note all other parameters are unchanged and environmental parameters are set as High.

Now, the score for Case 1 is 9.0, but Case 2 is 9.1. This is very strange as impact on C as high should ideally have a higher score value.

Does anyone have an explanation for this?

C: Impact on Confidentiality as High = 9.0 enter image description here

C: Impact on Confidentiality as Low = 9.1

enter image description here

Edit 1: Please visit these links. Refer to the score below shown against the Environmental score.
Link 1: Impact on Confidentiality as Low. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N/CR:H/IR:H/AR:H enter image description here

Link 2: Impact on Confidentiality as High. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/CR:H/IR:H/AR:H

enter image description here

one
  • 1.8k
  • 3
  • 23
  • 48