> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/risk-scores/what-exactly-do-the-environmental-score-metrics-in-the-enginsight-envs-manager-mean.md). # What exactly do the Environmental Score metrics in the Enginsight ENVS Manager mean? The Environmental Score (ENVS) is part of the Common Vulnerability Scoring System (CVSS). It allows you to adjust CVSS Base Metrics individually to the security and organizational requirements of your IT environment. This helps you better assess the actual risk that detected vulnerabilities pose to your organization. The [Environmental Score Manager](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/vulnerability-management/environmental-score-manager) in Enginsight allows you to select predefined ENVS metrics for assigned hosts or endpoints in order to calculate their security risk based on your infrastructure. In the following article, we will explain what the individual [CVSS Base Metrics](#cvss-base-metrics) and [Environmental Score Metrics](#environmental-score-metrics) mean in detail and how they are connected. *** ## CVSS Base Metrics **CVSS Base Metrics** describe the inherent characteristics of a vulnerability that remain constant over time and across environments. These include the [Exploitability Metrics](#exploitability-metrics), which describe how and under which conditions a vulnerability can be exploited by a potential attacker. They also include the [Impact Metrics](#scope-ms), which describe what type of damage can occur and to what extent if a vulnerability is exploited by an attacker. {% hint style="info" %} It is possible to adjust the Base Metrics in the advanced settings of the Environmental Score Manager in Enginsight. However, we explicitly recommend these settings for advanced users only. {% endhint %} ### Exploitability Metrics Exploitability metrics describe how and under which conditions a vulnerability can be exploited by a potential attacker. #### Attack Vector (MAV) The Attack Vector metric defines the network access or system access level an attacker needs in order to exploit the vulnerable component.

Value	Vector abbreviation	Description
Not Defined	MAV:X	The Attack Vector metric is not defined.
Network	MAV:N	An attacker can exploit the vulnerable component via remote network access, including over the internet.
Adjacent	MAV:A	An attacker needs network proximity to exploit the vulnerable component. This means the attack must be launched from the same physical or logical network.
Local	MAV:L	An attacker must access the vulnerable component locally or remotely, for example via SSH or RDP, in order to launch an attack.
Physical	MAV:P	An attacker must physically touch or manipulate the vulnerable component in order to launch an attack, for example by connecting a peripheral device.

#### Attack Complexity (MAC) The Attack Complexity metric defines the difficulty of the conditions for an attack that are outside the attacker’s control, such as required user interaction or the configuration of the target system.

Value	Vector abbreviation	Description
Not Defined	MAC:X	The Attack Complexity metric is not defined.
Low	MAC:L	There are no specific conditions that must be met for an attacker to exploit the vulnerable component or system.
High	MAC:H	There are specific conditions that must be met for an attacker to exploit the vulnerable component or system. For example, the attacker must perform preparatory steps, such as collecting reconnaissance data, or must trick a user into taking a specific action.

#### Privileges Required (MPR) The Privileges Required metric defines the permission level an attacker needs in order to exploit the vulnerable component or system.

Value	Vector abbreviation	Description
Not Defined	MPR:X	The Privileges Required metric is not defined.
None	MPR:N	An attacker does not need any special access rights to exploit the vulnerable component or system.
Low	MPR:L	An attacker needs basic user access rights to exploit the vulnerable component or system.
High	MPR:H	An attacker needs administrator access rights to exploit the vulnerable component or system.

#### User Interaction (MUI) The User Interaction metric defines whether user interaction is required for an attacker to exploit the vulnerable component or system.

Value	Vector abbreviation	Description
Not Defined	MUI:X	The User Interaction metric is not defined.
None	MUI:N	No specific user interaction is required for an attacker to exploit the vulnerable component or system.
Required	MUI:R	Specific user interaction is required for an attacker to exploit the vulnerable component or system. For example, the user must click a link, enter credentials, or install software.

#### Scope (MS) The Scope metric defines the extent to which an attack can affect systems beyond the exploited component or system.

Value	Vector abbreviation	Description
Not Defined	MS:X	The Scope metric is not defined.
Unchanged	MS:U	The impact of a successful attack remains limited to the affected component or system.
Changed	MS:C	The impact of a successful attack extends beyond the affected component or system.

### Impact Metrics Impact metrics describe what damage can occur, and to what extent, if a vulnerability is exploited by an attacker. #### Confidentiality Impact (MC) The Confidentiality Impact metric defines the extent to which confidential information is compromised if an attack on the vulnerable component or system is successful.

Value	Vector abbreviation	Description
Not Defined	MC:X	The Confidentiality Impact metric is not defined.
None	MC:N	In a successful attack on the vulnerable component or system, no confidential information is lost.
Low	MC:L	In a successful attack on the vulnerable component or system, some confidentiality is lost. An attacker has partial access to confidential data, but has no control over which data they can access.
High	MC:H	In a successful attack on the vulnerable component or system, all confidential information is fully compromised. An attacker has complete access to all resources, including critical data such as encryption keys or source code.

#### Integrity Impact (MI) The Integrity Impact metric relates to the trustworthiness and accuracy of data and defines the extent to which data can be manipulated if an attack on the vulnerable component or system is successful.

Value	Vector abbreviation	Description
Not Defined	MI:X	The Integrity Impact metric is not defined.
None	MI:N	In a successful attack on the vulnerable component or system, no data integrity is lost.
Low	MI:L	In a successful attack on the vulnerable component or system, some data integrity is lost. An attacker can manipulate a limited amount of data, but this has no severe impact on the vulnerable component or system.
High	MI:H	In a successful attack on the vulnerable component or system, data integrity is completely lost. An attacker can fully manipulate all data on the target system.

#### Availability Impact (MA) The Availability Impact metric defines the extent to which the availability of the vulnerable component or system is affected if an attack is successful.

Value	Vector abbreviation	Description
Not Defined	MA:X	The Availability Impact metric is not defined.
None	MA:N	In a successful attack on the vulnerable component or system, there are no restrictions on availability.
Low	MA:L	In a successful attack on the vulnerable component or system, availability is partially restricted. Reduced performance or partial interruptions may occur, but an attacker cannot cause a complete denial of service.
High	MA:H	In a successful attack on the vulnerable component or system, availability is fully affected. An attacker can bring the target system to a halt or cause a complete denial of service for all users.

*** ## Environmental Score Metrics **ENVS Metrics** [modify the base impact metrics](#impact-subscore-modification), allowing the CVSS score to be adjusted more precisely to the security and organizational requirements of your IT environment. ### Impact Subscore Modification Impact subscore modifications further modify the Impact metrics by describing the extent to which an exploited vulnerability can have negative effects on the affected organization or people associated with it. #### Confidentiality Requirement (CR) The Confidentiality Requirement metric defines the extent of the impact that a successful attack resulting in a loss of confidentiality has on the affected organization or people associated with it, such as employees, customers, or partners.

Value	Vector abbreviation	Description
Not Defined	CR:X	The Confidentiality Requirement metric is not defined.
Low	CR:L	The loss of confidentiality in a successful attack has limited negative effects on the organization or people associated with it.
Medium	CR:M	The loss of confidentiality in a successful attack has severe negative effects on the organization or people associated with it.
High	CR:H	The loss of confidentiality in a successful attack has catastrophic negative effects on the organization or people associated with it.

#### Integrity Requirement (IR) The Integrity Requirement metric defines the extent of the impact that a successful attack resulting in a loss of integrity has on the affected organization or people associated with it, such as employees, customers, or partners.

Value	Vector abbreviation	Description
Not Defined	IR:X	The Integrity Requirement metric is not defined.
Low	IR:L	The loss of integrity in a successful attack has limited negative effects on the organization or people associated with it.
Medium	IR:M	The loss of integrity in a successful attack has severe negative effects on the organization or people associated with it.
High	IR:H	The loss of integrity in a successful attack has catastrophic negative effects on the organization or people associated with it.

#### Availability Requirement (AR) The Availability Requirement metric defines the extent of the impact that a successful attack resulting in a loss of availability has on the affected organization or people associated with it, such as employees, customers, or partners.

Value	Vector abbreviation	Description
Not Defined	AR:X	The Availability Requirement metric is not defined.
Low	AR:L	The loss of availability in a successful attack has limited negative effects on the organization or people associated with it.
Medium	AR:M	The loss of availability in a successful attack has severe negative effects on the organization or people associated with it.
High	AR:H	The loss of availability in a successful attack has catastrophic negative effects on the organization or people associated with it.

***