At a university, a lab page lists every URL the research portal accepts, and a separate note says one parameter is not sanitized. Which statement describes the vulnerability?
Select an answer to reveal the explanation.
Short Explanation
A map of every door is not the same as a door that fails to latch. You have an unsanitized parameter on the research portal, and that input weakness is the vulnerability. The trap is the URL list, the hosting vendor, or the semester calendar.
Full Explanation
The unsanitized parameter, a weakness in how the research portal handles that input is the vulnerability. A vulnerability is a weakness in something that is exposed. The research portal accepts a parameter and does not sanitize it, so input can reach the application without the check that should have been there. That is a defect in how the portal handles data, whether or not anyone has used it yet. The published list of every URL the research portal accepts, documenting what is exposed documents every URL the portal accepts. That list tells you what is exposed. Exposure is not itself a weakness in the input check, and publishing the list does not create or remove the unsanitized parameter. The hosting vendor that runs the lab page, named with no weakness in the application names the vendor that hosts the lab page and names no weakness in the application. A vendor is not a vulnerability unless a defect in that vendor's system is the thing identified, and here the defect is the parameter handling. The semester calendar that only sets when students are assigned work on the lab page only sets when students are assigned the lab. A calendar does not accept the parameter and does not fail to sanitize it. Exam caveat: writing down the URLs an application accepts documents exposure. The weakness is the input that is not checked. Operational check: review the portal's handling of that parameter in the application notes or the code review and confirm the value is accepted without validation.