Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1395: Dependency on Vulnerable Third-Party Component

Class Incomplete

The product has a dependency on a third-party component that contains one or more known vulnerabilities.

How to prevent it (5 mitigations)

  1. Requirements, Policy

    In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.

  2. Requirements

    Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].

  3. Architecture and Design, Implementation, Integration, Manufacturing

    Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."

  4. Operation, Patching and Maintenance

    Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.

  5. Operation, Patching and Maintenance

    Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.

Source: MITRE CWE-1395

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • None 0.0
    CVE-2024-38526 Public exploit

    pdoc embeds link to malicious CDN if math mode is enabled

    pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

    mitmproxy pdoc pdoc PyPI
  • High 8.8
    CVE-2024-5246 Public exploit EPSS 31%

    NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability

    NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to ex…

    NETGEAR ProSAFE Network Management System Network devices