A vulnerability assessment identifies a web server running with directory listing enabled. A directory listing at '/backup/' reveals database dump files. What is the severity and impact of this finding?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because directory listing combined with accessible database dump files creates a direct path to downloading the entire database, which may contain credentials, PII, financial data, or other sensitive information — warranting critical severity. A is wrong because directory listing is a misconfiguration that exposes internal file structure and should never be enabled on production servers.
Full explanation below image
Full Explanation
B is correct because directory listing combined with accessible database dump files creates a direct path to downloading the entire database, which may contain credentials, PII, financial data, or other sensitive information — warranting critical severity. A is wrong because directory listing is a misconfiguration that exposes internal file structure and should never be enabled on production servers. C is wrong because directory listing does provide download links for listed files, not just file names. D is wrong because no information suggests this is limited to internal access; the context implies an internet-accessible web server.