A user creates an Ubuntu Linux virtual machine in Virtual Box on a Windows $10$ physical host. Virtual box is configured so that the virtual machine only has access to the files on its own virtual disk. Two weeks later, the user is using a web browser on the virtual machine. The virtual machine becomes infected with malware the user unknowingly acquires from a website. Assume, the perpetrator of the malware can now access and modify at will any file on the physical hard drive of the Windows host. In terms of CVSS$,$ which of these is now true?

A user creates an Ubuntu Linux virtual machine in Virtual Box on a Windows $10$ physical host. Virtual box is configured so that the virtual machine only has access to the files on its own virtual disk. Two weeks later, the user is using a web browser on the virtual machine. The virtual machine becomes infected with malware the user unknowingly acquires from a website. Assume, the perpetrator of the malware can now access and modify at will any file on the physical hard drive of the Windows host. In terms of CVSS$,$ which of these is now true?

The Attack Vector is physical.

The Integrity Impact is low.

The Scope has changed.

Confidentiality Impact is low.