CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A03: Injection

  Why this is correct

  In the OWASP Top 10:2021 framework, Cross-Site Scripting (XSS) has been consolidated into the A03: Injection category. Reflected XSS occurs when untrusted user input is dynamically injected into a web application's response without proper sanitization or encoding. Consequently, a vulnerability scan identifying a reflected XSS vulnerability with a CVSS vector indicating user interaction and scope change directly maps to this category.

• ✗

  A05: Security Misconfiguration

  Why it's wrong here

  Security misconfigurations typically involve default accounts, unencrypted services, or overly permissive CORS headers, which do not inherently require user interaction or trigger a CVSS scope change. In contrast, reflected XSS relies on a victim actively clicking a malicious link (User Interaction: Required) to execute script in the context of their browser session, altering the security scope. Therefore, this category is incorrect for a standard XSS finding.

• ✗

  A06: Vulnerable and Outdated Components

  Why it's wrong here

  This category applies when an application uses third-party libraries or frameworks with known, unpatched CVEs, which typically carry CVSS vectors reflecting direct system compromise or remote code execution. While a vulnerable component could theoretically contain an XSS flaw, a standard custom-code reflected XSS vulnerability is classified under injection rather than outdated software. The CVSS vector for outdated components usually lacks the specific scope-change and user-interaction requirements characteristic of reflected XSS.

• ✗

  A01: Broken Access Control

  Why it's wrong here

  Broken access control vulnerabilities occur when an application fails to properly enforce authorization boundaries, allowing users to access unauthorized resources or perform privileged actions. This category typically involves IDOR, path traversal, or privilege escalation, which do not rely on injecting executable scripts into a user's browser session. While an attacker might leverage XSS to steal session tokens and subsequently bypass access controls, the root vulnerability of reflected XSS itself is classified under injection.

Go deeper

Related to this question