Well, just pull up a CVSS calculator and start asking yourself questions and playing with it. As a fun game we would have people independently rate bugs on our Slack, mind you these are seasoned information security consultants that have broken a lot of software, and the ratings were hilariously far apart. Ask everyone to rate it low/medium/high/critical and consensus was pretty easy to achieve. Anyway the point is the criteria are quite subjectively. What comes out seems very quantitative, but it’s basically a pile of Jello in terms of how solid it is.

Honestly, I'm sure there are better sources - but this might be worthwhile just for the irony: https://www.tenable.com/blog/why-you-need-to-stop-using-cvss...

You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and likelihood to give you your own company risk rating. Ratings over a certain number (to be agree with at board level - in effect your risk appetite) should be treated (risk remediated, removed, transferred to a third party etc etc).

We also do this with pen test reports which suffer the same kinds of issues.

Usually find that sometimes a medium is a critical for us and some times a high is a low for us - based on performing this kind of assessment.

> You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and likelihood to give you your own company risk rating.

Totally agree, and I do that - check the vulnerability description, see if we’re using that part of the library, etc… it usually works out that we’re not actually affected by whatever the alert is.

This isn't specific to CVSS, it's the same for literally any kind of security-related rating or classification system.