Vulnerability Severity
info
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
When Takumi performs security assessments, the output report includes a list of vulnerabilities. Each vulnerability is assigned a severity level, which is classified into the following 5 levels.
| Severity | Description |
|---|---|
| Critical | Vulnerabilities that may have a critical impact on business continuity, such as large-scale personal information leakage or impacts on payments and entire systems. |
| High | Vulnerabilities that may have a significant impact on business continuity, such as irrecoverable personal information leakage or tampering with important information. |
| Medium | Vulnerabilities that may impact business continuity, such as recoverable leakage of information. |
| Low | Vulnerabilities that may have minor impacts on business continuity, or configuration issues that may exacerbate the occurrence of other vulnerabilities or their resulting damage. |
| None | Configuration issues or unintended behaviors that have no impact on business continuity. |
Below are some examples.
- Critical: Personal information stored in the database is leaked due to SQL injection.
- High: Part of the web application stops due to a specific request, making it impossible to provide related functionality.
- Medium: Partial broken access control leaks part of another user's information.
- Low: An open redirect allows users to be sent to an arbitrary external site.
- None: The version of the server or framework in use is disclosed.