What is the CVSS v3.1 Medium Severity Range?
In the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?
Community Votes
75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The CVSS v3.1 severity rating scale is tested, specifically identifying the numerical range for medium vulnerabilities, where the common trap is confusing the upper or lower bounds.
In the Common Vulnerability Scoring System (CVSS) v3.1, medium severity vulnerabilities are assigned specific numerical scores. This page establishes the correct range for the medium severity rating.
Choosing option A (4.0-6.0) is the most common mistake, likely due to confusing the CVSS v3.1 bounds with an older version or misremembering the upper limit.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D is correct because the official CVSS v3.1 specification explicitly defines the Medium severity rating as scores ranging from 4.0 to 6.9. This scale ensures a clear distribution of vulnerability impacts across the 0.0 to 10.0 spectrum. Any base score calculated within these bounds is categorized as a medium risk.Why the Other Options Are Wrong
Option A is incorrect because it cuts off the upper bound at 6.0, excluding valid medium scores from 6.1 to 6.9. Option B is wrong because a score of 3.9 falls into the Low category, not Medium. Option C is incorrect as it extends the lower bound down to 3.0, overlapping with the Low severity rating which ends at 3.9.Community Comment Notes
As killwitch noted, the official CVSS v3.1 classification clearly places "Medium: 4.0 - 6.9". NikoTomas also confirmed this range and provided the NIST NVD reference link. Dogeo mistakenly claimed the range was "4.0-6.0", which aligns with the incorrect option A.Official Reference
Exam Strategy
Memorize the exact numerical boundaries for the CVSS v3.1 severity ratings (None, Low, Medium, High, Critical) as they are strictly defined. Pay special attention to the transition points like 3.9 to 4.0 and 6.9 to 7.0 to avoid off-by-one or decimal boundary errors.