How does NVD assign impact types to vulnerabilities?
NVD assigns vulnerabilities the following impact types: confidentiality (“allows unauthorized disclosure of information”), integrity (“allows unauthorized modification”), availability (“allows disruption of service”), and security protection (“provides unauthorized access”). The “provides unauthorized access” category refers to getting some sort of general privileges in the application or entire computer (e.g., getting “root access” or an application account). This category has three possible subcategorizations: one for user level access to the operating system, another for getting administrator privileges, and another for some other type of privileged access.
