Using a web-based common vulnerability scoring system (CVSS) calculator, a security response team member performed an assessment on a reported…

The final vulnerability score, after adjusting for temporal and environmental metrics, is 8.0. According to the Common Vulnerability Scoring System (CVSS) v3.1 specification, scores are mapped to qualitative severity ratings. A score in the range of 7.0 to 8.9 is classified as "High" severity. While the initial base score of 9.9 was "Critical," the environmental and temporal metrics, which reflect the specific context of the organization's deployment, adjusted the final score into the "High" category. The final, context-adjusted score is the most accurate representation of risk for the organization.

A. Medium severity: This rating corresponds to scores between 4.0 and 6.9, which is lower than the final score of 8.0.

B. Critical severity: This rating corresponds to scores from 9.0 to 10.0. The initial base score was critical, but the final adjusted score is not.

C. Low severity: This rating corresponds to scores between 0.1 and 3.9, which is significantly lower than the final score of 8.0.

---

1. FIRST.org, Inc. (2019, June). Common Vulnerability Scoring System v3.1: Specification Document. Section 5, "Qualitative Severity Rating Scale," Table 14. This official specification document defines the severity rating scale. It explicitly states that a score of 7.0 - 8.9 is rated as "High."

2. National Institute of Standards and Technology (NIST). (n.d.). NVD Common Vulnerability Scoring System Calculator. National Vulnerability Database. Retrieved from https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator. The official NVD calculator, an implementation of the CVSS standard, displays the qualitative ratings corresponding to the score ranges, confirming that 8.0 is "High."

3. Carnegie Mellon University, Software Engineering Institute (SEI). (n.d.). A Complete Guide to the Common Vulnerability Scoring System (CVSS). Retrieved from https://www.sei.cmu.edu/our-work/vulnerability-analysis/vuln-analysis-resources/cvss/. This resource from a reputable research institution explains the CVSS framework and confirms the standard severity rating scale (Low, Medium, High, Critical) and their corresponding numerical score ranges.