Estimating the assessment difficulty of CVSS environmental metrics: An experiment