CVSS version $3\mathrm{.}1$ has a Base metric called Scope. The Scope metric captures the idea:

CVSS version $3\mathrm{.}1$ has a Base metric called Scope. The Scope metric captures the idea:

The availability of a software update to remedy a vulnerability

The impact to the availability of a resource from a successfully exploited vulnerability

Whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

The need for the user to take some action before a vulnerability can be exploited