more of a philosophical question, suppose there is one behavior which allows an attacker to do something with high impact but by itself cannot be used to cause that impact. For example, internet accessible admin portal which even though still requires authentication, it doesn't have IP whitelist nor 2FA.

Suppose that using the admin portal, an attacker can upload a shell and compromise the whole server.

Would you classify just having relaxed controls on the admin portal authentication as vulnerability?

If yes, what would you say just would you say is the CVSS score?

The risk? I guess here, the impact is high but the likelihood would be in relation to how easy is for someone to acquire valid credentials, which in most cases should be very low)

I would say it's not vulnerability since one needs valid credentials to actually be able to use the portal. But i hear people having a lot of different opinions so i would like to see some other people's thoughts.

It's similar to having a gun (admin portal) without bullets (credentials). It's only dangerous if you somehow manage to get bullets.


If the admin portal requires authentication then it is, by definition, not "exposed".

IP filtering or 2FA are additional layers of security and, while they can be helpful, are not always possible or worthwhile. As a result this certainly isn't a vulnerability and a CVSS score is simply not applicable.

Of course it always depends on the use-case. The admin portal for an anonymous cat-picture-voting site is probably perfectly fine without IP filtering or 2FA. The web portal for launching nuclear missles, however, is not (in fact, why does that even have a web portal in the first place!!!).

|improve this answer|||||

The Risk, Vulnerability, Impact are calculated bit differently.

Usually, weak authentication mechanism is not a vulnerability, but a risk. In the scenario that you've described, the Impact of someone gaining access (qualitative analysis) is critical (catastrophic, severe, etc.). But the occurence is low (obscurity, no known vulnerabilities in the authentication mechanisms (exploits), etc.). The last approach would be a quantitative risk analysis - what in materials and resources you will lose if someone would breach it? Are there card numbers? Accounts access? Cryptocurrency wallets? Business will go down due to reputation loss? If yes, then your risk would be high, if no then medium (however, that depends on what you value most).

|improve this answer|||||

It's an interesting question, and I'm not sure I can answer correctly. But here are my thoughts anyway.

It can't be a vulnerability. A vulnerability is something that can be exploited, and if it can't be exploited it can't be a vulnerability. The lack of an IP whitelist isn't something that can be exploited, if authentication requires a strong password.

It is probably a weakness. A weakness is something that is technically wrong or imperfect, and that in some cases might lead to a vulnerability (but not necessarily). So why should you let random IPs connect to the admin panel, if you are sure that only a few specific IPs will ever need to access it? The best, perfect, ideal thing to do would be to use an IP whitelist. So the lack of an IP whitelist would be a kind of weakness. It won't necessarily lead to a vulnerability, but it might. Example: imagine that an attacker steals the admin's password by shoulder-surfing. The attacker goes back to his basement and tries to connect... and if you have an IP whitelist the attacker will fail. In this example, what was only a weakness has become a vulnerability.

So in my opinion, implementing an IP whitelist in this case can be defined as defense in depth, because you are actually protecting from weaknesses, and preventing them from becoming vulnerabilities if something were to go wrong.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.