Summary by National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Document is a template and it doesn’t contain any actual data. The document itself just says “to obtain this data,
contact the owner”
Exposure of Sensitive But Unclassified (SBU) NASA COMSEC Document (NPR 1600.6A)
Disclosed by Bharat-bangari- Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Disclosed date about 1 month ago
- Priority P5 Bugcrowd's VRT priority rating
- Status Informational This vulnerability is seen as an accepted business risk
Summary by Bharat-bangari
Subject: Request for Re-evaluation - NPR 1600.6A COMSEC Document (Currently P5) → P4
Dear NASA VDP Team / Bugcrowd Triager,
I would like to respectfully request a re-review of the severity for the reported issue regarding the public exposure of the NASA Procedural Requirements NPR 1600.6A - Communications Security (COMSEC) document.
Current Rating: P5 (Informational)
Requested Rating: P4 (Low)
Why this should be considered P4:
Sensitive Nature of Content
This is an official NASA COMSEC policy document that details communications security procedures, key management, handling of classified/sensitive information, and protective services requirements. Even though it is marked SBU, public availability of internal COMSEC guidelines can provide valuable reconnaissance to adversaries (red teamers, nation-state actors, etc.).
Policy & Best Practices Violation
The document itself states it is not publicly distributed and should only be obtained through secure channels (PKI encrypted email, Registered mail, etc.) via the COMSEC Service Authority. Its unrestricted public exposure contradicts NASA’s own handling instructions.
Reconnaissance & OPSEC Impact
Exposure of such documents helps attackers understand NASA’s internal security posture, procedures, points of contact, and protection mechanisms — which is commonly accepted as Low severity (P4) in most VDPs when internal security documentation is leaked.
Precedent
Similar exposures of internal NASA policies/procedures have been accepted at P4 in the past.
I believe this meets the criteria for P4 (Low) as it provides meaningful information to attackers without being critical/high impact.
Please let me know if you need any additional details, screenshots, or links.
Thank you for your time and reconsideration.
Best regards,
BHARAT BANGARI