Revising 'Visible Detailed Error Page' Subcategory Name about vulnerability-rating-taxonomy HOT 4 CLOSED

I believe we should clarify the single entry with -Sensitive Data Exposure->Visible Detailed Error/Debug Page .

The intent is to reduce confusion and there is not a sufficient difference between these details to warrant another variant for tracking purposes.

from vulnerability-rating-taxonomy.

I think Sensitive Data Exposure->Visible Detailed Error Page is playing it's part well, because many times researchers would submit reports about displaying error pages and they are really not interested in understanding if they content being displayed over there is sensitive or not.

Hence, leaving this entry over there and creating a new subcategory for "Sensitive Data Exposure->Visible Detailed Error/Debug Page" would be good so that we can refer them to a P5 or P4 accordingly.

from vulnerability-rating-taxonomy.

I agree with @ryancblack. The intent is to reduce confusion when classifying all kinds of debug, error, or other kinds of page/content that should not be accessible in a production environment. Therefore current entry's naming adjustment seems to make most sense especially since the priority will be context based (null) regardless of the implementation.

If nobody else feels strongly about creating a dedicated subcategory (option 2), then please share any better naming adjustment ideas, there might be something more elegant than 'Visible Detailed Error/Debug Page'.

from vulnerability-rating-taxonomy.

Implemented in #8

from vulnerability-rating-taxonomy.