CVSS helps describe technical severity consistently. Product priority also depends on data value, reachability and business impact.
Evaluation approach
Define the vulnerability, attack conditions and consequences before selecting metrics. Explain each vector choice and how threat or environmental context is used. A score alone hides the reasoning.
Application example
Determine whether a local file exposes only the signed-in user's information, other users' data or authority to perform server operations. A modified device alone is not enough context for scoring.
Limits and considerations
Technical severity and commercial loss are not identical. Low-volume, high-value transaction risks may need separate business priority.
Checks and decisions
- Publish the vector with the score
- Document assumptions
- Assess business impact separately
Resolve disagreements through attack prerequisites and evidence rather than debating the number in isolation.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.