A vulnerability scanner reports a critical finding on a web server: 'Apache HTTP Server 2.4.49 Path Traversal and Remote Code Execution (CVE-2021-41773).' The server is in production. What is the risk-prioritization factor that should be considered first?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because risk prioritization for a critical CVE must consider the CVSS severity, availability of public exploits (which drastically increases exploitation likelihood), and exposure level (internet-facing increases attack surface). A is wrong because recurrence history informs patching process maturity but does not change the current risk level.
Full explanation below image
Full Explanation
B is correct because risk prioritization for a critical CVE must consider the CVSS severity, availability of public exploits (which drastically increases exploitation likelihood), and exposure level (internet-facing increases attack surface). A is wrong because recurrence history informs patching process maturity but does not change the current risk level. C is wrong because hardware depreciation is irrelevant to the security risk of the vulnerability. D is wrong because vendor statements may inform awareness but do not change exploitability or exposure.