According to vulnerability score scheme what score a Client Side DOS Attack can get?

Question

For example I am testing a website and I found some invalid (error) pages. You visit the page and receive status code 500. But now if you reload the page or visit any valid page on website it just stuck on loading until you clear cookies of that site from browser. So maybe this activity make current user cookies/session invalid on server side I guess so you clear cookies and reload the page and it becomes normal. In terms of severity in which category we can identify this issue.

There are lots of way to exploit this bug in real life. For Example - Send this page link to victim so He/She might think that whole website is down and you may lead them to other optional sites or your own website for your personal benefits maybe.

Answer 1

I would grade it with this CVSS-vector:

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

which results in a score of 3.5 (LOW)

Reasoning:

• Attack Vector - Network: You send the malicious link to the victim via internert
• Complexity - Low: It is rather easy to spot the vuln and sending a link is easy as well
• Privileges - Low: You need an account on the page to find the vuln
• User interaction - required: Victim needs to click on the link
• Scope - unchanged: nothing changes beyond your session in the web application
• Confidentiality+Integrity - None: Not affected
• Availablity - Low: Only single session is affected