A website is given to pentester. It is observed that the website has a login page at https://example.com/admin. In this login page it is also possible to enumerate from error messages that the user "admin" actually exists. The pentester examines the page for brute-force attack and there is no limitation in the number of login attempts and 100k requests can be sent in 1 hour.

What is CVSS 3.0 score of this vulnerability in final pentest report? Is it a medium or high vulnerability?

  • I assume you used a scoring tool? What did it come up with? What's your reasoning for a med or high? We can help if you need to better understand something, but we won't just score something for you.
    – schroeder
    Commented Jul 10 at 16:32
  • I’m voting to close this question because the OP needs to describe their own scoring methodology.
    – schroeder
    Commented Jul 10 at 16:34
  • I mentioned CVSS 3.0 scoring system, I don't understand (describe their own scoring methodology) or (scoring tool) Commented Jul 10 at 16:46
  • That's the system. But there are tools and methods to help you score a vulnerability. You need to use those. You don't just "guess" at a score.
    – schroeder
    Commented Jul 10 at 16:52


Browse other questions tagged .