And in practice, it means CVSS is only really meaningful on software which exists as a complete system, like a web application or a device - questions like "is

And in practice, it means CVSS is only really meaningful on software which exists as a complete system, like a web application or a device - questions like "is user interaction required to exploit this vulnerability" are usually unanswerable for individual software components.