1. 5
  1.  

  2. 2

    CVSS works only if you can trust the person who prioritizes the vulnerabilities. It just does not take configurational issues into account effectively