I have a web application which is vulnerable to XXE attack. The impact of this vulnerability is, it can do a port scan by sending a malicious XML that does a request to a specific host+port in the server instance/network.
When calculating the CVSS score for this issue, I have the following concern for 'Scope' vector of the CVSS score 3.1.
When calculating the scope, CVSS Score specification says, if the resources managed by the same security authority, scope is unchanged. However, security authorities of the resources(vulnerable web application and the impacted resource that access via the XXE vulnerability) in the aforementioned issue, can be changed along with the deployment. As per my understanding, the impacted component might be managed by the same security authority or another authority depending on the server deployment.
- In that case how should we proceed the scope value to calculate the CVSS score? What is the common practice for this kind of scenario?
- Or else, is there anything that I have missed when understanding 'Scope' definition?