Which Exploitability criterion expresses the presence or absence of a user interaction requirement?

Which Exploitability criterion expresses the presence or absence of a user interaction requirement?

• A. Attack complexity.
• B. Privileges required.
• C. Scope.
• D. User interaction.

Answer: (D)

The idea being tested is whether exploiting a vulnerability requires a user to take action. In CVSS and similar models, the User Interaction metric answers exactly that: does exploitation depend on a user performing some action (like opening a file or clicking a link) or can it occur without any user involvement? If user interaction is required, that is noted by this criterion and influences the overall exploitability score. The other criteria describe different aspects—Attack Complexity looks at how hard it is to exploit, Privileges Required indicates the level of access needed before exploitation, and Scope determines whether the exploit can affect resources beyond the original scope. So the criterion that expresses the presence or absence of a user interaction requirement is the User Interaction metric.

The idea being tested is whether exploiting a vulnerability requires a user to take action. In CVSS and similar models, the User Interaction metric answers exactly that: does exploitation depend on a user performing some action (like opening a file or clicking a link) or can it occur without any user involvement? If user interaction is required, that is noted by this criterion and influences the overall exploitability score. The other criteria describe different aspects—Attack Complexity looks at how hard it is to exploit, Privileges Required indicates the level of access needed before exploitation, and Scope determines whether the exploit can affect resources beyond the original scope. So the criterion that expresses the presence or absence of a user interaction requirement is the User Interaction metric.