A9: Using Components with Known Vulnerabilities · 2017

Vulnerable and outdated dependencies, frameworks or components inherit known flaws and expand the application's attack surface.

Summary

Vulnerable and outdated dependencies, frameworks or components inherit known flaws and expand the application's attack surface.

How the attack works

The application retains a dependency with a known flaw; requests reach that component without the available update.

Example

Vulnerable · Pseudocode

# CVE-2017-5638 (Jakarta Multipart)
struts2-core = 2.5.10
# Security update not applied

Fix: Inventory components and update to a maintained version without the vulnerability, including transitive dependencies.

Security advisory: CVE-2017-5638

Prevention

Maintain an inventory and SBOM of direct and transitive dependencies.
Monitor security advisories and update promptly.
Remove unmaintained or unnecessary components.

Lineage

2013 · A9: Using Components with Known Vulnerabilities Continues in 2017
2017 · A9: Using Components with Known Vulnerabilities Renamed and moves up in 2021
2021 · A06: Vulnerable and Outdated Components Renamed and moves up from A9:2017
2025 · A03: Software Supply Chain Failures New and expanded from vulnerable components

2013:A9 → 2017:A9: The components category retains rank 9.
2017:A9 → 2021:A06: The category changes to Vulnerable and Outdated Components.
2021:A06 → 2025:A03: Vulnerable Components expands into Software Supply Chain Failures.

Sources

Open official source ↗

Buy me a coffee