CWE-1395 - Dependency on Vulnerable Third-Party Component
CWE-1395
- Abstraction:
- Class
- Structure:
- Simple
- Status:
- Incomplete
- Weakness Name
Dependency on Vulnerable Third-Party Component
- Description
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
Many products are large enough or complex enough that part of their functionality uses libraries, modules, or other intellectual property developed by third parties who are not the product creator. For example, even an entire operating system might be from a third-party supplier in some hardware products. Whether open or closed source, these components may contain publicly known vulnerabilities that could be exploited by adversaries to compromise the product.
- Common Consequences
Scope: Confidentiality, Integrity, Availability
Impact: Varies by Context
Notes: The consequences vary widely, depending on the vulnerabilities that exist in the component; how those vulnerabilities can be "reached" by adversaries, as the exploitation paths and attack surface will vary depending on how the component is used; and the criticality of the privilege levels and features for which the product relies on the component.
- Related Weaknesses
- Release Date:
- 2023-01-31
- Latest Modification Date:
- 2023-10-26
Free security scan for your website