nyanbinary on Nostr: No, not necessarily. CVSS severity levels are great for bulk classification & ...

No, not necessarily. CVSS severity levels are great for bulk classification & priorisation but do not always correctly reflect individual findings - pretty much every pentester I know constantly complains about customers wanting cvss claasifications because of this. Additionally I kinda disagree with this CVSS string in this case, given it assumes UI:N which I always find iffy for reflected XSS.