CWE-1395: Dependency on Vulnerable Third-Party Component
ID
CWE-1395
Abstraction
Class
Structure
Simple
Status
Incomplete
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
Many products are large enough or complex enough that part of their functionality uses libraries, modules, or other intellectual property developed by third parties who are not the product creator. For example, even an entire operating system might be from a third-party supplier in some hardware products. Whether open or closed source, these components may contain publicly known vulnerabilities that could be exploited by adversaries to compromise the product.
Modes of Introduction
| Phase | Note |
|---|---|
| Architecture and Design | The product architect or designer might choose a component that is already known to contain vulnerabilities or has a high likelihood of containing vulnerabilities in the future. |
| Implementation | For reasons of compatibility or stability, developers might choose a third-party component, such as a library, that is already known to contain vulnerabilities. |
| Patching and Maintenance | Since all products contain vulnerabilities, over time, a third-party component will be discovered to have a vulnerability. |
Applicable Platforms
| Type | Class | Name | Prevalence |
|---|---|---|---|
| Language | Not Language-Specific | ||
| Operating_system | Not OS-Specific | ||
| Architecture | Not Architecture-Specific | ||
| Technology | Not Technology-Specific |
Loading...