Issue Details
Using Components with Known Vulnerabilities
Aliases: None
Explanation
In OWASP 2017, A9 Using Components with Known Vulnerabilities combines related risk themes across Vulnerable and Outdated Components, Software Supply Chain Failures. Vulnerable components add known exploitable flaws when outdated or unsupported dependencies are used. Supply chain failures introduce risk through compromised dependencies, build pipelines, or third-party services. These weaknesses are often exploited as a chain: attackers start with weak input or trust boundaries, pivot through authorization or session gaps, and then move toward data exposure, integrity loss, or service disruption. Operationally, this can increase incident frequency, enlarge blast radius, and raise both remediation cost and compliance exposure when controls are missing or inconsistently enforced across services.
Remedy
For OWASP 2017 A9 Using Components with Known Vulnerabilities, apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Maintain SBOM visibility, patch quickly, remove unsupported libraries, and monitor vulnerability advisories. Audit dependencies, verify package provenance, scan continuously, and isolate build and deployment trust boundaries. Treat mitigation as a continuous program: define security requirements up front, enforce them in CI/CD gates, and verify effectiveness with threat modeling, code review, automated testing, and recurring penetration testing. Add monitoring and incident-response readiness so misconfigurations, abuse patterns, and control regressions are detected early and corrected before they become repeatable attack paths.
| Year | Rank | Category |
|---|---|---|
| 2017 | #9 | A9 - Using Components with Known Vulnerabilities |
| 2021 | #6 | A06 - Vulnerable and Outdated Components |
| 2025 | #3 | A03 - Software Supply Chain Failures |