Using Components with Known Vulnerabilities

Multiple vulnerability databases report known vulnerabilities in software components. Software that uses a vulnerable component (even just as a dependency of one of its components) is exposed to attack.

How to Prevent

There should be a patch management process in place to:

* Remove unused dependencies, unnecessary features, components, files, and documentation.

* Continuously inventory the versions of both client-side and server-side components (e.g. frameworks, libraries) and their dependencies using tools like versions, DependencyCheck, retire.js, etc. Continuously monitor sources like CVE and NVD for vulnerabilities in the components. Use software composition analysis tools to automate the process. Subscribe to email alerts for security vulnerabilities related to components you use.

* Only obtain components from official sources over secure links. Prefer signed packages to reduce the chance of including a modified, malicious component.

* Monitor for libraries and components that are unmaintained or do not create security patches for older versions. If patching is not possible, consider deploying a virtual patch to monitor, detect, or protect against the discovered issue.

Every organization must ensure that there is an ongoing plan for monitoring, triaging, and applying updates or configuration changes for the lifetime of the application or portfolio.

Source : A9_2017-Using_Components_with_Known_Vulnerabilities

Readable Content : A06_2021-Vulnerable_and_Outdated_Components