## Decoding CVSS Scores

**Common Vulnerability Scoring System (CVSS)** looks objective, but requires interpretation.

### The Metrics (CVSS v3.1)
*   **AV (Attack Vector)**: Network (N), Adjacent (A), Local (L), Physical (P).
    *   *Network* is worst (Remote).
*   **AC (Attack Complexity)**: Low (L) vs High (H).
    *   *Low* means a script kiddie can do it.
*   **PR (Privileges Required)**: None (N), Low (L), High (H).
    *   *None* is worst (Unauth RCE).
*   **UI (User Interaction)**: None (N) vs Required (R).
    *   *Required* means user must click a link (Phishing).
*   **S (Scope)**: Unchanged (U) vs Changed (C).
    *   *Changed* means breaking out of the sandbox (VM Escape).
*   **CIA**: Confidentiality, Integrity, Availability.

### Example: Log4J
**CVSS: 10.0** (Critical)
`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
*   Network Access.
*   Low Complexity.
*   No Privs.
*   No User Click.
*   Total compromise.
*   **This is why it set the internet on fire.**