How should CVSS scores be used to determine whether a vulnerability is failing?

How should CVSS scores be used to determine whether a vulnerability is failing?

• A. Any score above 4.0 is automatically failing
• B. Only DoS vulnerabilities above 4.0 are failing
• C. A vulnerability above 4.0 is failing only if it is not exclusively DoS
• D. CVSS scores are not used

Answer: (C)

CVSS scores quantify how severe a vulnerability is, guiding whether remediation is needed. In PCI ASV practice, a vulnerability with a base score above 4.0 signals medium to high risk and should be considered for remediation. However, if the only impact is Denial of Service (DoS) with no other effects, it is not counted as a failing vulnerability. So, only vulnerabilities above 4.0 that are not exclusively DoS are treated as failing. The other options don’t fit because a high score isn’t automatically a fail in all cases (pure DoS-only issues are excluded), and CVSS is indeed used to gauge severity.

CVSS scores quantify how severe a vulnerability is, guiding whether remediation is needed. In PCI ASV practice, a vulnerability with a base score above 4.0 signals medium to high risk and should be considered for remediation. However, if the only impact is Denial of Service (DoS) with no other effects, it is not counted as a failing vulnerability. So, only vulnerabilities above 4.0 that are not exclusively DoS are treated as failing. The other options don’t fit because a high score isn’t automatically a fail in all cases (pure DoS-only issues are excluded), and CVSS is indeed used to gauge severity.