Security

Scope Change (CVSS)

A CVSS metric (S:C) indicating that exploiting the vulnerable component affects resources beyond its own security authority, such as a flaw in an update tool that compromises the whole operating system. Scope-changed scores are weighted higher than same-scope ones.

Deep dive

Learn Article

How a Path Traversal in an Update Client Turns a Downloaded File Into Root

Update tools run as root, write files from the network and trust the paths inside what they download. Why that makes a mundane traversal bug a full operating-system compromise.

intermediate 6 min read

Back to glossary