The Common Vulnerability Scoring System (CVSS) allows, among other things, to quantify the severity of software vulnerabilities.
What is the functional relationship between a CVSS and the associated risk? In other words, what would be the shape of the function risk(CVSS)=...?
I am asking this because I would like to have a "cumulated insecurity level" of a host, to distinguish between, for instance, a host with five
CVSS=2 vulns and the one with two
CVSS=10. The function above would help to set a weight for each CVSS, so that the cases in the example above are not equivalent (which would be the case of the function was linear -- which I feel it is not the case, it should be rather exponential to highlight the worst cases).