# Vulnerability Evaluation Criteria {#evaluation-criteria}

When Takumi performs security assessments, each vulnerability in the output report is rated on three scales: [severity](#severity), [attack possibility](#possibility) and [urgency](#urgency). Urgency follows from the combination of the severity and attack possibility judged for each vulnerability.

## Severity {#severity}

Each vulnerability is assigned a severity level, which is classified into the following 5 levels.

| Severity | Description                                                                                                                                                                        |
| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Critical | Vulnerabilities that may have a critical impact on business continuity, such as large-scale personal information leakage or impacts on payments and entire systems.                |
| High     | Vulnerabilities that may have a significant impact on business continuity, such as irrecoverable personal information leakage or tampering with important information.             |
| Medium   | Vulnerabilities that may impact business continuity, such as recoverable leakage of information.                                                                                   |
| Low      | Vulnerabilities that may have minor impacts on business continuity, or configuration issues that may exacerbate the occurrence of other vulnerabilities or their resulting damage. |
| None     | Configuration issues or unintended behaviors that have no impact on business continuity.                                                                                           |

Below are some examples.

- **Critical**: Personal information stored in the database is leaked due to SQL injection.
- **High**: Part of the web application stops due to a specific request, making it impossible to provide related functionality.
- **Medium**: Partial broken access control leaks part of another user's information.
- **Low**: An open redirect allows users to be sent to an arbitrary external site.
- **None**: The version of the server or framework in use is disclosed.

## Attack Possibility {#possibility}

Alongside its severity, each vulnerability is assigned an attack possibility, which is classified into the following 4 levels.

| Possibility | Description                                                                                                                                                                                 |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| High        | Exploitable at any time, with no special precondition.                                                                                                                                      |
| Medium      | Exploitable once a certain condition is met, such as luring a victim into an action or an unusual configuration being in place.                                                             |
| Low         | Requires relatively complex conditions, or several conditions to hold at the same time.                                                                                                     |
| Impossible  | Cannot be carried out at the time of the assessment, or requires conditions an ordinary attacker cannot meet, such as already holding administrator privileges or the target's credentials. |

## Urgency {#urgency}

Each finding carries an urgency, which says in what order the findings should be addressed. It is not judged on its own: it follows from the combination of the finding's [severity](#severity) and its [attack possibility](#possibility). In the table below the vertical axis is the possibility and the horizontal axis is the severity.

|            | Critical | High   | Medium | Low    | None |
| ---------- | -------- | ------ | ------ | ------ | ---- |
| High       | Urgent   | Urgent | High   | Medium | None |
| Medium     | Urgent   | High   | Medium | Low    | None |
| Low        | High     | Medium | Low    | Low    | None |
| Impossible | Medium   | Low    | Low    | Low    | None |

The overall A-E rating of a report follows the highest urgency it carries: E for Urgent, D for High, C for Medium, B for Low, and A when nothing above None was found.