more of a philosophical question, suppose there is one behavior which allows an attacker to do something with high impact but by itself cannot be used to cause that impact. For example, internet accessible admin portal which even though still requires authentication, it doesn't have IP whitelist nor 2FA.
Suppose that using the admin portal, an attacker can upload a shell and compromise the whole server.
Would you classify just having relaxed controls on the admin portal authentication as vulnerability?
If yes, what would you say just would you say is the CVSS score?
The risk? I guess here, the impact is high but the likelihood would be in relation to how easy is for someone to acquire valid credentials, which in most cases should be very low)
I would say it's not vulnerability since one needs valid credentials to actually be able to use the portal. But i hear people having a lot of different opinions so i would like to see some other people's thoughts.
It's similar to having a gun (admin portal) without bullets (credentials). It's only dangerous if you somehow manage to get bullets.