A thing that I find extremely suspicious in the CVSS ratings - and I do not understand how this decision got made or justified - is: how does it work, if "not defined" is given the same weight as "per category worst case scenario"?
https://en.wikipedia.org/wiki/Common_Vulnerability_Scoring_System