report-templates

CVSS 3.1 Vector Reference

Format

CVSS:3.1/AV:[N|A|L|P]/AC:[L|H]/PR:[N|L|H]/UI:[N|R]/S:[U|C]/C:[N|L|H]/I:[N|L|H]/A:[N|L|H]

Score by Severity Tier

Pre-built Vectors by Vulnerability Type

Pre-auth RCE (internet-facing):  AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H  = 9.8
Post-auth RCE (authenticated):   AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H  = 8.8
SQLi (data exfil possible):      AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N  = 8.1
SQLi (read-only):                AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N  = 6.5
Stored XSS (unauthenticated):    AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N  = 6.1
Stored XSS (post-auth):         AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N  = 5.4
Reflected XSS:                   AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N  = 6.1
SSRF (internal access):         AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N  = 7.2
SSRF (cloud metadata):          AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N  = 9.6
Path traversal (file read):      AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N  = 7.5
LPE (local exploit):            AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H  = 7.8
Insecure deserialization:        AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H  = 8.1
IDOR (sensitive data):          AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N  = 6.5
IDOR (data modification):       AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N  = 8.1
Auth bypass (admin access):      AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N  = 9.1
Weak JWT (crackable secret):    AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N  = 7.4
Hardcoded credentials:           AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N  = 9.1
Open redirect:                   AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N  = 6.1
Directory listing:               AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N  = 5.3
Information disclosure:          AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N  = 5.3
Missing HTTPS:                   AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N  = 4.8
CSRF (state-changing):          AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N  = 6.5

Executive Summary Template (1 Page)

## Executive Summary

[CLIENT NAME] engaged [FIRM NAME] to conduct a [TYPE: internal/external/web application/full-scope]
penetration test of [SCOPE DESCRIPTION] between [START DATE] and [END DATE].

### Risk Posture

During the assessment, [FIRM NAME] identified **[N] findings** across [M] systems,
including **[X] Critical**, **[Y] High**, **[Z] Medium**, **[W] Low**, and **[V] Informational** vulnerabilities.

The overall risk posture is assessed as: **[CRITICAL | HIGH | MEDIUM | LOW]**

### Key Findings

The most significant finding was **[FINDING TITLE]**, which allowed testers to [IMPACT DESCRIPTION —
e.g., "gain unauthenticated remote code execution on the production API server and access
the customer database containing [N] records"].

Additional critical findings included:
- **[Finding 2]**: [One-sentence impact]
- **[Finding 3]**: [One-sentence impact]

### Business Impact

Exploitation of the identified vulnerabilities could result in:
- Unauthorized access to sensitive customer data (regulatory impact: GDPR, PCI-DSS)
- Complete compromise of [SYSTEM] infrastructure
- Reputational damage and loss of customer trust
- [SPECIFIC DOLLAR/OPERATIONAL IMPACT IF QUANTIFIABLE]

### Remediation Priority

| Priority | Timeline | Actions |
|----------|----------|---------|
| Immediate (0-7 days) | Patch [CVE], revoke [credential], disable [service] |
| Short-term (8-30 days) | Implement [control], remediate [N] High findings |
| Medium-term (31-90 days) | Address [N] Medium findings, establish [process] |

[FIRM NAME] is available to provide remediation guidance and conduct a retest upon completion.

Technical Finding Template

---

## [ID]: [SEVERITY] — [Vulnerability Title]

| Field | Value |
|-------|-------|
| **Severity** | CRITICAL / HIGH / MEDIUM / LOW / INFO |
| **CVSS 3.1 Score** | [SCORE] ([CVSS:3.1/AV:.../...]) |
| **CWE** | CWE-[NUMBER]: [NAME] |
| **ATT&CK TTP** | [T-NUMBER]: [TECHNIQUE NAME] |
| **Affected Asset** | [IP / URL / Component] |
| **CVE** | CVE-XXXX-XXXXX (if applicable) |
| **Date Identified** | [UTC DATE] |

### Description

[2-4 sentence technical description of the vulnerability. Explain what it is, why it exists,
and what conditions allow it to be exploited. Avoid jargon that a non-technical reader
cannot follow in the executive summary.]

### Business Impact

[1-2 sentences describing the business consequence if this vulnerability is exploited.
Frame in terms of data confidentiality, regulatory requirements, operational availability,
or financial impact.]

### Steps to Reproduce

**Prerequisites:** [Access level required, e.g., "Unauthenticated" / "Valid user account"]

1. Navigate to `[URL]` using a web browser or send the following request:
   ```http
   [REQUEST METHOD] [PATH] HTTP/1.1
   Host: [HOST]
   [HEADERS]

   [BODY IF APPLICABLE]

2. [Step 2 description]

3. The application responds with:

   [RESPONSE SNIPPET or COMMAND OUTPUT]
   

4. [Step describing the impact demonstration]

Evidence

• Screenshot/Output: evidence/[DATE]/[TARGET]/[category]/[filename]
• Request/Response: evidence/[DATE]/[TARGET]/[category]/[filename].http
• Video recording: evidence/[DATE]/[TARGET]/[category]/[filename].mp4 (if captured)

Remediation

Immediate Actions:

1. [Specific immediate mitigation step — e.g., "Disable the affected endpoint at the WAF layer"]
2. [Second immediate step if needed]

Long-term Fix: [Specific code-level or configuration-level remediation. Include version number to upgrade to, configuration value to set, or code pattern to implement.]

Verification: [How to confirm the fix is effective — e.g., "Re-run the proof of concept steps above; the server should return HTTP 403 or equivalent error."]

References

• [CVE link or NVD URL if applicable]
• [Vendor advisory URL]
• [OWASP / CWE / NIST link]
• [ATT&CK technique URL: https://attack.mitre.org/techniques/T-NUMBER/]

---

## 5×5 Risk Matrix

```markdown
## Risk Matrix

|  | **Negligible (1)** | **Minor (2)** | **Moderate (3)** | **Major (4)** | **Catastrophic (5)** |
|---|---|---|---|---|---|
| **Almost Certain (5)** | MEDIUM 5 | HIGH 10 | HIGH 15 | CRITICAL 20 | CRITICAL 25 |
| **Likely (4)** | LOW 4 | MEDIUM 8 | HIGH 12 | HIGH 16 | CRITICAL 20 |
| **Possible (3)** | LOW 3 | MEDIUM 6 | MEDIUM 9 | HIGH 12 | HIGH 15 |
| **Unlikely (2)** | LOW 2 | LOW 4 | MEDIUM 6 | MEDIUM 8 | HIGH 10 |
| **Rare (1)** | INFO 1 | LOW 2 | LOW 3 | LOW 4 | MEDIUM 5 |

*Score = Likelihood × Impact*

Remediation Language Bank (Top 20 Vulnerability Types)

SQL Injection

Implement parameterized queries (prepared statements) for all database interactions. Do not construct SQL queries using string concatenation with user-supplied input. Apply input validation with allowlists at the application layer. Deploy a WAF rule to detect and block common SQL injection patterns as a defense-in-depth measure.

Cross-Site Scripting (XSS)

Implement context-sensitive output encoding for all user-controlled data rendered in HTML, JavaScript, CSS, and URL contexts. Use a Content Security Policy (CSP) header that rest