Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Severity Category

Christian | Last updated: Jul 20, 2020 06:58PM UTC

When the severity of a found vulnerability is classified as "information", what does it really mean? And also what is the degree of severity. Based on the other severity category it is obious a high is more severe than a medium and a low. Where does "information" fall on this spectrum. Is "information" less severe than a low?

Ben, PortSwigger Agent | Last updated: Jul 22, 2020 10:33AM UTC

Hi Chris, Some of the information that is gained during a vulnerability scan can not be automatically assigned to a particular vulnerability type, severity score or real risk category. The use of the informational category is designed for this type of discovery and it is left to the user to investigate the findings in order to determine whether they will have an impact on their organization. As an example, the presence of the robots.txt file in a web application is not in itself considered a vulnerability but the contents of it might highlight restricted areas of that particular site and provide an attacker with an increased attack surface.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.