Clickjacking issues should go up with its score. about vulnerability-rating-taxonomy HOT 4 CLOSED

Hi Sasi,

Thank you for your input. Clickjacking is addressed in the VRT in multiple entries. If for example a bug bounty report simply pointed out lack of X-Frame-Options headers, that would be a P5 - accepted risk:
Server Security Misconfiguration->Lack of Security Headers->X-Frame-Options (P5)

If on the other hand it was noted that there is clickjacking possible on a sensitive action, that would be addressed by a different P4 entry:
Server Security Misconfiguration->Clickjacking->Sensitive Action (P4)

The VRT's default priorities may be adjusted on case by case basis. You are mentioning chaining vulnerabilities. We definitely like to see those and upgrade the priority to reflect the increased impact.

Hope this helps!

from vulnerability-rating-taxonomy.

P4 isn't enough for sensitive action, cuz if attacker can delete account via clickjacking I think it should go up then P4.
Reporter MUST show a critical case that he/she able to do things, XSS, delete account are only few critical issues and should be higher then P4.

from vulnerability-rating-taxonomy.

This paragraph from the Bugcrowd’s Vulnerability Rating Taxonomy PDF document (get it here) should provide more insight on how vulnerabilities are rated:

"Priority is a Baseline
The recommended priority, from Priority 1 (P1) to Priority 5 (P5), is a baseline. That having been said, while this baseline priority might apply without context, it’s possible that application complexity, bounty brief restrictions, or unusual impact could result in a different rating. As a customer, it’s important to weigh the VRT alongside your internal application security ratings.

For bug hunters, if you think a bug’s impact warrants reporting despite the VRT’s guidelines, or that the customer has misunderstood the threat scenario, we encourage you to submit the issue regardless and use the Bugcrowd Crowdcontrol commenting system to clearly communicate your
reasoning."

from vulnerability-rating-taxonomy.

@thefishermanhacker - Thanks again for your feedback! @plr0man's comments are spot on. There are many situations where we may upgrade the recommended priority based on context however the default priority for Clickjacking is varant dependant.

Similarly, IDOR is entirely context dependant.

I will close this issue but do let us know if you have any follow-up questions after reviewing some of our classification rationale in the VRT PDF.

from vulnerability-rating-taxonomy.