A library database listens on a wide network with weak privileged authentication. What finding class fits best?
Select an answer to reveal the explanation.
Short Explanation
A database open to half the campus with a soft admin login is a vault with the door propped open. Reachability plus weak auth is a classic high-impact combo. Lock down who can talk to it and how they prove who they are.
Full Explanation
A library database that listens on a wide network with weak privileged authentication fits the finding class of over-exposed database services with weak privileged auth—high-impact common-service misconfigurations. Downgrading priority unless the web front end is also vulnerable ignores direct database attack paths that never need the app tier. Wide exposure is not fine merely because the vendor is still supported; support status does not shrink network reachability or fix weak admin credentials. Using the same password for privileged database accounts and the app pool concentrates blast radius and is a separate hygiene failure, not a justification. Exam caveat: exposure plus privileged auth weakness is enough to report even without a full dump in the evidence appendix. Operational check: note listen address and port reachability from the approved library segment, demonstrate weak or default privileged auth within RoE limits, recommend network restriction to app tiers, strong unique secrets, and removal of unnecessary admin listeners. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.