logging vpcab issue not severe enough

[jmanico]

IN https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html

I think that

authn_password_change_fail[:userid]¶

should be more severe than info, maybe even crtical

[kwwall]

IMO, 'critical' is probably overreacting, especially company still has a massive user base along with outdated mandatory password expiration and/or password complexity rules. In such situations, unless you are also comparing the 'New Password' and 'Confirm Password' on the client-side (which is advisable, but often not done), you are bound to have a lot of finger farts or violations of the password complexity rules that are still in place. And no one wants to deal with all that noise, especially if it's marked as critical. I personally think just logging it as a warning is adequate. Just my $.02.

[jmanico]

Right now it's just info, which I think is not enough. I'd at least like to see this get bumped to warn.

[mackowski]

Agree @jmanico do you want to make PR?