I'm having some trouble calculating CVSS v3.0 scores in some findings I've encountered.
In particular, one finding is a simple server information disclosure via default error pages. It is very similar to the following: https://nvd.nist.gov/vuln/detail/CVE-2017-4013
Using the CVSS v3.0 calculator, I have also arrived at the exact same CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and score (5.3, Medium).
Intuitively, this finding shouldn't be a Medium since attackers can't really do much via banner disclosure. I would think it should be a Low or even Informational. IMHO, CVSS v3.0 calculator does not provide enough granularity in the C/I/A impact components to properly account for this.
However, I notice in the link above that there's also an "impact score" and "exploitability score", which are appropriately low in both cases. There's no mention however of how these are derived, not in the link, or the CVSS calculator at first.org. A quick Google search doesn't yield anything either.
May I know how these are calculated, and can they be used to modify the risk ratings?