A library assessment finds the same vulnerability class on a jury P…

Question

A library assessment finds the same vulnerability class on a jury PII system and on a public brochure site. How should severity be handled?

Accepted Answer

Contextualize severity by asset and data criticality rather than treating the class as uniform. — Same hole, different treasure. A brochure site leak is annoying; a jury PII system leak is a crisis. Severity has to respect what the asset protects.

Answer

Always score both as identical criticals regardless of data sensitivity.

Answer

Downgrade the PII system because courts are low priority.

Answer

Skip severity entirely and list only CVE IDs.

A library assessment finds the same vulnerability class on a jury PII system and on a public brochure site. How should severity be handled?

Short Explanation

Full Explanation