A library Linux system shows world-writable permissions on /etc/passwd or /etc/shadow-class files. What is the correct severity framing for that finding?
Select an answer to reveal the explanation.
Short Explanation
Leaving passwd or shadow world-writable is like taping the master key under the welcome mat. Those files underpin who can log in and with what hashes—weak perms are a five-alarm finding. Call it critical, not cosmetic.
Full Explanation
Authentication-critical files such as /etc/passwd, /etc/shadow, and related sudoers-class configuration must remain tightly permissioned. World-writable or otherwise overly permissive modes enable unauthorized account modification or credential exposure themes and are treated as high-severity privilege issues. They are unrelated to SSH firewall posture and do not prove SELinux is working. Testers should flag them immediately during Linux privilege-escalation enumeration.