Question

During an internal engagement, your credentialed scan reports three findings on separate hosts: (1) a low-severity information-disclosure flaw on a web app that leaks internal hostnames and a service account name, (2) a medium-severity SMB signing-not-required setting on a file server, and (3) a low-severity anonymous LDAP bind on a domain controller. Individually each rates below the client's remediation threshold. The client asks why you flagged these as a single high-priority item in your report. Which analysis best justifies elevating the combined risk?

Accepted Answer

The three findings can be chained: leaked account details plus anonymous LDAP enumeration feed credential targeting, while SMB signing-not-required enables NTLM relay to authenticate to the file server, forming a realistic attack path to domain resources

Answer

Because all three appear on the same scan report, CVSS base scores should be summed to produce a single aggregate severity that exceeds the client's threshold

Answer

Any finding on a domain controller is automatically critical regardless of the other hosts, so the LDAP bind alone justifies the high rating

Answer

The scanner grouped them together, indicating they share a common CVE and must be remediated with one patch