In exploitability metrics, which criterion expresses whether the attack requires the involvement of multiple authorities?

In exploitability metrics, which criterion expresses whether the attack requires the involvement of multiple authorities?

• A. Attack complexity.
• B. Privileges required.
• C. User interaction.
• D. Scope.

Answer: (D)

Scope examines whether exploiting a vulnerability would touch resources beyond the security boundary of the vulnerable component. If the attack could affect other components or resources managed by different authorities or domains, the scope changes to reflect that broader, multi-domain impact. That cross-boundary aspect is what this criterion captures, highlighting when multiple authorities or trust boundaries would be involved to realize the full effect of the exploit. The other factors describe how hard the attack is to carry out (attack complexity), what level of privileges are needed (privileges required), or whether user participation is required (user interaction); they focus on the mechanics of exploitation rather than cross-boundary reach.

Scope examines whether exploiting a vulnerability would touch resources beyond the security boundary of the vulnerable component. If the attack could affect other components or resources managed by different authorities or domains, the scope changes to reflect that broader, multi-domain impact. That cross-boundary aspect is what this criterion captures, highlighting when multiple authorities or trust boundaries would be involved to realize the full effect of the exploit.

The other factors describe how hard the attack is to carry out (attack complexity), what level of privileges are needed (privileges required), or whether user participation is required (user interaction); they focus on the mechanics of exploitation rather than cross-boundary reach.