Base Metrics

Exploitability Metrics

Attack Vector (AV)
Attack Complexity (AC)
Attack Requirements (AT)
Privileges Required (PR)
User Interaction (UI)

Vulnerable System Impact Metrics

Confidentiality (VC)
Integrity (VI)
Availability (VA)

Subsequent System Impact Metrics

Confidentiality (SC)
Integrity (SI)
Availability (SA)

Supplemental Metrics

Safety (S)
Automatable (AU)
Recovery (R)
Value Density (V)
Vulnerability Response Effort (RE)
Provider Urgency (U)

Environmental (Modified Base Metrics)

Exploitability Metrics

Attack Vector (MAV)
Attack Complexity (MAC)
Attack Requirements (MAT)
Privileges Required (MPR)
User Interaction (MUI)

Vulnerable System Impact Metrics

Confidentiality (MVC)
Integrity (MVI)
Availability (MVA)

Subsequent System Impact Metrics

Confidentiality (MSC)
Integrity (MSI)
Availability (MSA)

Environmental (Security Requirements)

Confidentiality Requirements (CR)
Integrity Requirements (IR)
Availability Requirements (AR)

Threat Metrics

Exploit Maturity (E)