In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are assigned CVSS) i thought of using OWASP top 10 2017 as a measurement yard-stick. More specifically, I want to employ a scale of 1-10 for vulnerabilities such that vulnerabilities with
A1 are assigned
A6 are assigned
5. Will this be fair/reasonable enough or are there better ways for doing something like this ?
Update: Just stumbled upon CWSS and realized it is designed for scoring web applications using
CWE categorization. For example
2011 CWE/SANS Top 25 Most Dangerous Software Errors were scored using prevalence scores.
Does anyone know if something similar is available for top 10 2017 ?