Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Vulnerabilities reported as Low

Harjinder | Last updated: Mar 09, 2021 11:35PM UTC

Hi Support, Some Vulnerabilities are reported as Low. But based on the description of the Vulnerabilities they should be high. Can you clarify why they are report as low and should those be reported as High. 1.Strict transport security not enforced 2.Unencrypted communications Please clarify. Thanks

Ben, PortSwigger Agent | Last updated: Mar 10, 2021 09:57AM UTC

Hi Harjinder, We use our own bespoke vulnerability classification based upon our in-house security researchers expertise. Our default classification is determined based on the potential impact of the vulnerability. This classification should always be reviewed by the user, based on their knowledge of the purpose and context of the associated functionality.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.