In the context of trying to determine whether to use CVSS or SSVC framework, run each framework against the same set of Mediawiki tasks.
Select a few Mediawiki tasks that are good examples of several categories of bug/issues (ideally ones that have already been CVSS rated before public release, to optimize time). One of them should be a XSS.Add environmental score to the already calculated score to generate full CVSS rating for those tasks + show the impact of the environmental criteria on the full-score.- Edit from Dec 14th: select a few, very representatives Mediawiki tasks and run a full CVSS scoring analysis on them (one xss would be good)
- Run the SSVC framework against all of the same tasks
- Show how the score is different
- Analyze differences and showcase which score is the most accurate and why
- Provide feedback on which one is easier to calculate
- Show the form used to generate both scores