PCI scoring contradiction
Risk ratings in a PCI security assessment are directly based on CVSS v2 scores, here’s an extract from CVSS v2 scoring guide:
SCORING TIP #2: When scoring a vulnerability, consider the direct impact to the target host only. For example, consider a cross-site scripting vulnerability: the impact to a user’s system could be much greater than the impact to the target host. However, this is an indirect impact. Cross-site scripting vulnerabilities should be scored with no impact to confidentiality or availability, and partial impact to integrity.
This seems to contradict the objectives of PCI which is to secure card holder data. Whether or not this requires 0wning a server is irrelevant. And with XSS you can obviously compromise card holder data without having to compromise any servers. Go figure.