A weakness exists in a web application, but no attacker activity is observed. What best describes the weakness?

1. Threat actor
2. Confirmed incident
3. Business impact analysis
4. Vulnerability