A penetration tester reviews a SAST vulnerability scan report. The following vulnerability has been reported as high severity: The tester inspects the source file and finds the variable response is de

The correct answer is B. False positive. A false positive occurs when a security tool incorrectly flags safe code as a vulnerability. In this case, the SAST scan reports a high-severity command injection vulnerability related .innerHTML = response However, upon reviewing the source file, the penetration tester finds tha

Submitted by fatima_kr· Mar 6, 2026Vulnerability discovery and analysis

Question

A penetration tester reviews a SAST vulnerability scan report. The following vulnerability has been reported as high severity:

The tester inspects the source file and finds the variable response is defined as a constant and is not referred to or used in other sections of the code. Which of the following describes how the tester should classify this reported vulnerability?

Options

AFalse negative
BFalse positive
CTrue positive
DLow severity

How the community answered

(38 responses)

A
11% (4)
B
82% (31)
C
5% (2)
D
3% (1)

Explanation

A false positive occurs when a security tool incorrectly flags safe code as a vulnerability. In this case, the SAST scan reports a high-severity command injection vulnerability related .innerHTML = response However, upon reviewing the source file, the penetration tester finds that the response variable is defined as a constant and is never used dynamically in the code. This means: - The value of response is not influenced by user input. - There is no real security risk because no external input is being injected into innerHTML Since the scanner incorrectly identified a vulnerability where none exists, this is a false positive.

Topics

#SAST#Vulnerability classification#False positive#Code review

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice