{"uuid": "c12ae8ac-edf1-440e-be1c-7b6908321f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44228", "type": "seen", "source": "https://t.me/hacking_Attack/41719", "content": "Pentest report and residual risk\nhttps://www.reddit.com/r/Pentesting/comments/sm0gmn/pentest_report_and_residual_risk/\n\nLog4j has a severity score of 10 out of 10. Let say this bug was found during pentest and classified as critical severity. https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Residual risk is the risk that remains after efforts to identify and eliminate some or all types of risk have been made If customer can't fix this issue, but mitigated the risk by introducing WAF, and requested us to lower the risk from critical to something else (lower) in pentest report. Can we really do that? Seems like they don't like critical findings on pentest report and would like us to change it as they already have WAF to protect the app.  This is very good example of security through obscurity. What should you do in a case like this?    submitted by    /u/w0lfcat  (https://www.reddit.com/user/w0lfcat) \n [link] (https://www.reddit.com/r/Pentesting/comments/sm0gmn/pentest_report_and_residual_risk/)   [comments] (https://www.reddit.com/r/Pentesting/comments/sm0gmn/pentest_report_and_residual_risk/)", "creation_timestamp": "2026-09-01T20:01:56.647384Z"}