038 – Business information leak
Description
It is possible to obtain business information, such as: - Username list - Strategic information - Employees information - Clients information - Providers information
Impact
Obtain sensitive information to create new attack vectors.
Recommendation
Based on the classification of the information found, set the necessary controls to guarantee that information is accessible only to right users.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): N
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X