Vulnerable Components
Vulnerable components are libraries/frameworks the application depends on that contain known vulnerabilities, which attackers exploit to attack the app; an OWASP Top 10 vulnerability.
Purpose
To understand dependency vulnerability management and defense; the core of supply chain security.
Mechanism
Application dependencies contain libraries with CVEs (e.g., Log4Shell, Equifax Struts), which attackers exploit. Defenses: SCA scanning, dependency updates, CVE monitoring, minimal dependencies, SBOM.
Use cases
- Dependency vulnerability management
- SCA scanning
- Supply chain security