Here are some potential justifications for lowering the severity of the weak cipher suites alert in Nuclei from medium to low:
- The risks associated with weak cipher suites are mainly related to interception of traffic and decryption of sensitive data in transit. This requires a man-in-the-middle position which limits the scale of potential abuse.
- For an external scan, it is difficult to determine the true impact of weak cipher suites without knowing details of the application architecture and data flows. There could be other protections in place that mitigate the risk.
- Weak cipher suites alone do not enable direct remote code execution or access to underlying resources. Additional vulnerabilities would need to be chained to result in system compromise.
- The classification of "weak" cipher suites is also subjective and changes over time. Something considered weak today may still be commonly used and considered acceptable by many organizations.
- The CVSS score ranges from none to low for interception of non-sensitive data in transit. For external scanning, it's uncertain if truly sensitive data is exposed.
- Remediation requires updating server configurations across potentially many hosts. While recommended in the long term, it is not always trivial for organizations to deploy in the short term.
- There are likely higher severity issues that should be prioritized for remediation first, rather than just the acceptable cipher suites.
While weak cipher suites are not advisable, their ease of exploitation is limited in many real-world scenarios. And when performing external testing, it's difficult to determine the true impact. Given these factors, lowering the severity rating seems reasonable compared to other more serious remote bugs. But organizations should still look to phase out weak ciphers in a responsible manner.
