I'm working on a school project, which is a tool that generate security auditing reports in PDF.
I'm currently using testssl.sh which check for SSL/TLS Vulnerabilities
When a vulnerability is identified, I want to indicate to the user how much important the threat is to confidentiality and how easy it is to exploit.
I made this table a few days ago, and according to the CVSS v2 scoring system, the majority of the vulnerabilities severity are Medium, and many vulnerabilities share the same scores. I got confused on how to rate these vulnerabilities based on Impact/Exploitability and whether a vulnerability is a real threat.
Is there a way to classify these vulnerabilities into risk categories (i.e: Low, Medium, High) to show to the user how serious a detected vulnerability is ?