Glossary: Security Fundamentals

Scope (S)

Also written: S:C, S:U, scope changed

A CVSS 3.1 metric for whether the attack can break out of the vulnerable component into others (C, changed) or stays inside it (U, unchanged). Scope changed lifts Log4Shell from 9.8 to 10.0.