By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values for confidentiality, integrity and availability:
none : 0.0 partial impact : 0.275 complete: 0.660
So, I would like to understand why is this given a value of 0.66 for a full impact? Why the value can not be higher than 0.66 since we have complete impact on the asset? In this case, how to explain a vulnerability with a full score for the three security attributes?
Furthermore, why assigning the same scores for all the three security attributes confidentiality, integrity and availability?