A library XSS finding only triggers in an obsolete browser feature few patrons still use. How should the tester frame impact?
Select an answer to reveal the explanation.
Short Explanation
A leaky faucet in a locked basement still leaks — you just say so honestly. Obscure XSS belongs in the report with realistic likelihood tied to who still uses that path, not as instant database RCE and not swept under the rug.
Full Explanation
XSS impact depends on affected users, session cookie attributes, CSP, and browser defenses. Findings that require obsolete features should still be reported with calibrated likelihood and impact rather than inflated criticality or silent omission. XSS is not automatically database RCE. Professional CPTS-style reporting balances completeness with realistic framing for decision makers.