The CVE lists a 7.3 CVSS score for an unauthenticated SQL injection via a findAll endpoint — and that number should raise immediate skepticism. SQL injection with network attack vector and no authentication typically lands in the 9.0–9.8 range, so something unusual is happening in the scoring that the CVE vector string doesn't fully explain.
The most likely explanation is that the vendor scored confidentiality and integrity impact as "Low" rather than "High." This is defensible only if you assume the findAll endpoint returns nothing beyond user IDs or boolean flags. But that's the wrong frame for SQL injection. Unlike reflected XSS or path traversal, SQLi doesn't care what the application normally returns — once you have injection, you can pull any data the database contains via UNION queries or boolean-based extraction. An attacker isn't limited to what the endpoint deliberately exposes; they're querying the database directly. Treating this as a minor information leak requires ignoring what SQL injection actually does.
The other contributing factor is likely undefined temporal metrics. Vendors frequently leave exploitability and remediation availability as "Not Defined" rather than applying factors like active exploit code or available workarounds that would push the score higher. Without those adjustments, the base score alone is an incomplete picture — and the CVSS spec explicitly warns against using base scores in isolation.
Here's what matters practically: assume the effective severity in your environment could be significantly higher than 7.3. If the findAll endpoint is accessible without authentication — particularly across a network boundary or VPN — treat this as a critical finding pending your own impact assessment. The vendor's score reflects their limited visibility into how the endpoint actually behaves in production, not a verified upper bound on damage. Validate whether session cookies or other contextual guards are actually enforced, because if they're not, you're looking at unauthenticated database compromise, not user enumeration.