First of all, there are three different metrics to calculate the global CVSS score. These are: Base Metrics, Temporal Metrics and Environmental Metrics.
Temporal Metrics and Environmental Metrics are optional and these are calculated using the Base ones as an input value. To have a better overview of these metrics and their equation, take a look of this picture:
![cvss score](../../images/3826584699.webp)
(source: first.org)
Generally, the base and temporal metrics are specified by vulnerability bulletin analysts, security product vendors, or application vendors because they typically have better information about the characteristics of a vulnerability than do users. The environmental metrics, however, are specified by users because they are best able to assess the potential impact of a vulnerability within their own environments.
That means that the user must provide the environmental metrics whereas a vulnerability scanner might provide the others.
As far as I know, Nessus includes just the Base and the Temporal Scores. Thus, Nessus is not able to get the value of the Environmental metrics. The environmental metrics depends on the organization's necessities.
Otherwise, if you want to calculate the CVSS score using the Environmental Metrics, you can not use an automatized vulnerability scanner as Nessus. You would need to assess the system and decide the threat that the organization is capable to bear.
In order to calculate the global CVSS score, you can mix the results of a Nessus scan with the assess of the system.
There is available a CVSS v2 calculator
In addition, it looks as if Qualys works in a similar way. The scanner provides the Base and the Temporal Score, moreover the user provides the Environmental metrics.
The CVSS Environmental Metric group captures the characteristics of a vulnerability that are associated with the user's IT environment.
More information of Qualys and CVSS
I suppose that the global CVSS Score should take the worst situation possible.