Glossary
CVSS vector
The text string that spells out, metric by metric, how a CVSS score was obtained.
The CVSS vector is the textual form of a score: the list of values chosen for each metric. It shows why a flaw gets its score, and lets anyone recompute it. A common v3.1 example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which yields a score of 9.8.
The v3.1 base metrics: AV, attack vector (N network, A adjacent, L local, P physical); AC, attack complexity (L low, H high); PR, privileges required (N none, L low, H high); UI, user interaction (N none, R required); S, scope (U unchanged, C changed); C, I and A, impact on confidentiality, integrity and availability (N, L or H).
v4.0 adds AT (attack requirements), separates the impact on the vulnerable system (VC, VI, VA) from the impact on subsequent systems (SC, SI, SA), and splits UI into None, Passive or Active. In both versions, AV:N with PR:N and UI:N describes a flaw exploitable remotely, without an account or any action from the victim: the profile to handle first.