While I was doing source code review of API handlers for REST APIs, I found a security issue.

This issue is that some methods have the annotation @PreAuthorize("permitAll()").

If I want to document this as a finding and give it a CVSS score, how can this be done? Should I consider this finding when calculating the score, or should I consider the impact of it, which is any user accessing the endpoints?

This struggle appeared when I started doing the calculation, for example:

  • Attack vector: I don't see here what the attack vector is as the finding I found by reading the code.
  • Attack complexity: same for this, since there is no attack but its a finding at the level of the code.

Same goes for most of the other fields.

  • 1
    How do you know it's a vulnerability if you haven't identified how to attack it?
    – vidarlo
    Commented Mar 12 at 11:48
  • Assuming I have a sensitive endpoint getAllUsersInfo, which should only be called by an ADMIN, and this method have permitAll, isn't this considered a vulnerability ?
    – anonymous
    Commented Mar 12 at 12:06
  • 1
    So ... how would it be exploited? CVSS doesn't describe how you found something, but describes the vulnerability. I'm not sure this is a CVSS scorable issue until you know how this is actually an issue aside from a concern you have. So, you need to be able to say "because of this code, there can be an unauthorised disclosure of information by doing X". Is there any other controls around these methods?
    – schroeder
    Commented Mar 12 at 12:38
  • @schroeder exploitability should be a seperate thing, no? The vulnerability is a weakness, so it's obvious the weakness here the lack of authorization check. Now the question if there are other controls is valid, and mmay mitigate this issue, but I want to give a score to this issue explicitly, isn't that feasible? It is similar to detecting a concatinted string paramter in a query and thus raising a vulnerability.
    – anonymous
    Commented Mar 12 at 13:20
  • Please read the documentation on CVSS. We have provided it to you previously. Attack Vector and Attack Complexity are part of the "Exploitability Metrics". So, please make sure that your scoring follows the guidance from FIRST.
    – schroeder
    Commented Mar 12 at 13:23

1 Answer 1


It sounds like you haven't quite confirmed this to be a vulnerability, especially if you don't know how or if it is exploitable. Many vulnerabilities are found looking at code; how you found them does not impact the CVSS rating.

However, some reasonable inferences can be made from the information you have shared.

Attack Vector

It sounds like the application serves a REST API. REST APIs are typically served over the network, often exposed to a corporate intranet or the public internet. In this case, the attack vector is "network" (AV:N).

Attack Complexity

If the attack is truly as simple as hitting the vulnerable endpoint while unauthenticated or low privileged, then this is almost certainly "low" (AC:L).

  • Thank you that makes sense!
    – anonymous
    Commented Mar 24 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .