Complexity, Both Length and Char Type Not Enforced about vulnerability-rating-taxonomy HOT 1 CLOSED

Hi @SYNTAXERRORBA,

Thanks for writing in. The entry you mention that addresses single character passwords being allowed is in fact rated P3 by the VRT, but please keep in mind that VRT provides suggested priority and the decision to fix/reward is always up to the customer.

Weak password policy is one of those issues that are often by design due to usability concerns and customers accept the risk that comes with it. However there are many cases where weak or lack of password policy are unintended which makes corresponding reports valid and rewardable.

I am sorry you've had bad experience, but downgrading this type of issues to P5 as a general rule would prevent valuable security research from being provided to the customers that need it.

Hope this helps!

from vulnerability-rating-taxonomy.