CVSS Base score

The base score describes how bad a flaw is in the abstract, identically for everybody in the world.

That is its purpose and its limit. It knows nothing about whether the affected system is reachable, what it does, or whether anybody is exploiting it. Using it as a work queue means treating a flaw on an isolated test box exactly like the same flaw on the payment gateway, which is how teams stay permanently busy without becoming safer.

Checked against the primary source.

More on Vulnerability management