BETA Shoulder jest w wersji beta — Wyniki mogą czasami być błędne. Twoja opinia kształtuje to, co naprawimy w następnej kolejności. Podziel się opinią
#6 A06:2021

Vulnerable and Outdated Components

Components such as libraries, frameworks, and other software modules run with the same privileges as the application. If a vulnerable component is exploited, it can cause serious data loss.

Przeglad

Previously titled Using Components with Known Vulnerabilities. It is #2 in the Top 10 community survey but also had enough data to make the Top 10 via data analysis.

Jak Atakujacy To Wykorzystuja

Zrozumienie wzorcow atakow pomaga budowac lepsze zabezpieczenia. To sa techniki, ktore zespoly bezpieczenstwa monitoruja.

Known vulnerability exploitation

Attackers target publicly disclosed vulnerabilities in popular libraries before applications are patched.

Sygnal wykrywania: Exploit attempts matching known CVE patterns, targeting specific library endpoints

Supply chain compromise

Malicious code is introduced through compromised or typosquatted packages.

Sygnal wykrywania: Unexpected network connections, unusual package behaviors

Jak Zapobiegac

  • Remove unused dependencies, features, components, and documentation
  • Continuously inventory component versions and their dependencies
  • Monitor sources like CVE and NVD for vulnerabilities in components
  • Only obtain components from official sources over secure links
  • Monitor for unmaintained libraries that don't receive security patches
  • Use virtual patching via web application firewall if needed

CWE z Wykrywaniem Shoulder (1)

Te CWE maja reguly wykrywania Shoulder. Kliknij, aby zobaczyc konkretne podatnosci i poprawki.

Inne Zmapowane CWE (2)

Te CWE sa zmapowane do tej kategorii, ale nie maja jeszcze regul Shoulder.