Question

A vulnerability analyst confirms a critical SQL injection flaw in a customer-facing web application. The scan report includes the affected URL, the CWE classification, and a recommended remediation. When the analyst tries to assign the finding for remediation, there is confusion: the infrastructure team says the OS is fully patched, the DevOps team says they only manage the CI/CD pipeline, and the application development team says they were never notified of scan results. Which underlying vulnerability management weakness is MOST directly responsible for this breakdown?

Accepted Answer

The vulnerability management program has not established clear asset and remediation ownership (RACI) for findings

Answer

The organization lacks a defined remediation SLA for critical findings

Answer

The scanner was run without authentication, producing an incomplete report

Answer

The finding should have been validated as a false positive before assignment