問題文
A finding can be triggered only when a logged-in user opens a link that the attacker sends. Which CVSS metric captures the fact that a person other than the attacker has to do something?
選択肢
- Attack Complexity, because the attacker cannot control whether the link is opened, and a condition that depends on the choice of another person is the clearest example of something outside the attacker's control.
- Temporal metrics, because the timing of the click is a recorded condition that changes over time and is kept outside the base score.
- Privileges Required, because the person who opens the link is logged in, so the flaw cannot be reached from a session that holds no account.
- User Interaction, because the flaw is reachable only when someone besides the attacker takes an action.