Reading a finding
Every finding has the same shape: what is at risk, the proof, and how to fix it, signed off by a Zaaf researcher.
The header
- Severity and CVSS. Critical, High, Medium, Low or Info, with the CVSS 3.1 score where one applies.
- Verified by Zaaf. The finding was reproduced and signed off by a researcher before it was published.
- ID. A stable reference such as
ZF-0001-01: the scan number, then the finding's number in that scan.
Impact, Evidence and Fix
| Tab | What it tells you |
|---|---|
| Impact | What is at risk, in business terms, often with a number (for example, how many customers are affected), plus a plain description of the weakness. |
| Evidence | The exact requests and responses, or steps, that prove it. Engineers can replay them. |
| Fix | The change that closes the weakness. |
Under the tabs you'll find the weakness class (CWE), the CVSS score and when the finding was first seen.
Severity levels
| Severity | Typical meaning |
|---|---|
| Critical | Direct access to other customers' data or money, or full control of the system. Fix now. |
| High | Serious impact with few conditions, such as taking over an account or a role. |
| Medium | Real impact that needs extra conditions, or a weakness that widens another attack. |
| Low | Limited impact. Worth fixing in normal work. |
| Info | No direct impact, but useful hardening or context. |
Next: what to do with a finding.