Vulnerability Evaluation Criteria
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
When Takumi performs security assessments, each vulnerability in the output report is rated on three scales: severity, attack possibility and urgency. Urgency follows from the combination of the severity and attack possibility judged for each vulnerability.
Severity
Each vulnerability is assigned a severity level, which is classified into the following 5 levels.
| Severity | Description |
|---|---|
| Critical | Vulnerabilities that may have a critical impact on business continuity, such as large-scale personal information leakage or impacts on payments and entire systems. |
| High | Vulnerabilities that may have a significant impact on business continuity, such as irrecoverable personal information leakage or tampering with important information. |
| Medium | Vulnerabilities that may impact business continuity, such as recoverable leakage of information. |
| Low | Vulnerabilities that may have minor impacts on business continuity, or configuration issues that may exacerbate the occurrence of other vulnerabilities or their resulting damage. |
| None | Configuration issues or unintended behaviors that have no impact on business continuity. |
Below are some examples.
- Critical: Personal information stored in the database is leaked due to SQL injection.
- High: Part of the web application stops due to a specific request, making it impossible to provide related functionality.
- Medium: Partial broken access control leaks part of another user's information.
- Low: An open redirect allows users to be sent to an arbitrary external site.
- None: The version of the server or framework in use is disclosed.
Attack Possibility
Alongside its severity, each vulnerability is assigned an attack possibility, which is classified into the following 4 levels.
| Possibility | Description |
|---|---|
| High | Exploitable at any time, with no special precondition. |
| Medium | Exploitable once a certain condition is met, such as luring a victim into an action or an unusual configuration being in place. |
| Low | Requires relatively complex conditions, or several conditions to hold at the same time. |
| Impossible | Cannot be carried out at the time of the assessment, or requires conditions an ordinary attacker cannot meet, such as already holding administrator privileges or the target's credentials. |
Urgency
Each finding carries an urgency, which says in what order the findings should be addressed. It is not judged on its own: it follows from the combination of the finding's severity and its attack possibility. In the table below the vertical axis is the possibility and the horizontal axis is the severity.
| Critical | High | Medium | Low | None | |
|---|---|---|---|---|---|
| High | Urgent | Urgent | High | Medium | None |
| Medium | Urgent | High | Medium | Low | None |
| Low | High | Medium | Low | Low | None |
| Impossible | Medium | Low | Low | Low | None |
The overall A-E rating of a report follows the highest urgency it carries: E for Urgent, D for High, C for Medium, B for Low, and A when nothing above None was found.