Question

A penetration tester completes an authenticated scan of a client's environment and must prioritize remediation guidance. Four validated (non-false-positive) findings remain. Given the tester's goal of prioritizing by real-world exploitability and business impact, which finding should be ranked highest?

Accepted Answer

A CVSS 8.1 deserialization vulnerability on an internet-facing web server that processes payment transactions, with a weaponized Metasploit module publicly available

Answer

A CVSS 9.8 remote code execution flaw on an internal database server that is not reachable from the internet and requires VPN access, with no public exploit code available

Answer

A CVSS 7.5 information-disclosure issue on a public marketing site that exposes server version banners

Answer

A CVSS 6.5 stored XSS vulnerability in an internal HR portal accessible only to authenticated employees