Attack Vector (AV)The context by which vulnerability exploitation is possible. The more remote an attacker can be, the greater the score.
Attack Complexity (AC)Measurable security conditions the attacker must overcome to exploit the vulnerability, e.g. evading defenses such as ASLR or encryption.
Attack Requirements (AT)Prerequisite conditions of the vulnerable system that must exist for the attack to succeed, e.g. a race condition or a machine-in-the-middle position.
Privileges Required (PR)The level of privileges an attacker must possess before successfully exploiting the vulnerability.
User Interaction (UI)Whether a human user other than the attacker must participate for the attack to succeed.
Confidentiality (Vulnerable System) (VC)Impact to the confidentiality of information managed by the vulnerable system, i.e. unauthorized access to data.
Integrity (Vulnerable System) (VI)Impact to the integrity of the vulnerable system, i.e. unauthorized modification of data.
Availability (Vulnerable System) (VA)Impact to the availability of the vulnerable system, i.e. disruption of access to services or resources.
Confidentiality (Subsequent System) (SC)Impact to the confidentiality of systems beyond the vulnerable system (subsequent systems).
Integrity (Subsequent System) (SI)Impact to the integrity of systems beyond the vulnerable system (subsequent systems).
Availability (Subsequent System) (SA)Impact to the availability of systems beyond the vulnerable system (subsequent systems).