Skip to main content

Use of software with known vulnerabilities

Description​

The system uses the version of a software or dependency with known vulnerabilities.

Impact​

Exploit found vulnerabilities in the affected components.

Recommendation​

Update the affected software to the versions recommended by the vendor.

Threat​

Authenticated attacker from the Internet.

Expected Remediation Time​

⌚ 60 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: L
  • Availability: L

Temporal​

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result​

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
  • Score:
    • Base: 5.0
    • Temporal: 4.5
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples​

Compliant code​

Search for known vulnerabilities of any dependencies used on the code, replace them for safer alternatives

{
  "name": "test",
  "version": "1.0.0",
  "description": "nothing",
  "main": "index.js",
  "author": "Luis Saavedra",
  "license": "MIT",
  "private": false,
  "dependencies": {
    "@angular/core": "^13.3.3",
    "cloudron-sysadmin": "1.0.0",
  },
}

Non compliant code​

Example importing dependencies with known vulnerabilities

{
  "name": "test",
  "version": "1.0.0",
  "description": "nothing",
  "main": "index.js",
  "author": "Luis Saavedra",
  "license": "MIT",
  "private": false,
  "dependencies": {
    "@angular/core": "^13.3.3",
    "cloudron-sysadmin": "1.0.0",
    "script-manager": "0.8.6",
    "slug": "0.9.0"
  },
  "devDependencies": {
    "xmldom": "0.4.0"
  }
}
dependencies {
  compile "io.springfox:springfox-swagger-ui:2.6.1"
  compile("io.springfox:springfox-swagger-ui")
  compile(group: 'javax.mail', name: 'mail')
  compileOnly group: 'org.apache.logging.log4j', name: 'log4j-core', version: '2.13.2'
  implementation group: 'org.json', name: 'json', version: '20160810'
  implementation(group: 'javax.mail', name: 'mail', version: '1.4')
}

Examples using software with known vulnerabilities

using System;
class ExampleClass{
  public void ExampleMethod(){
    //Is the URI is tainted, it may lead to parsing of a malicious XML schema
    XmlSchemaCollection xsc = new XmlSchemaCollection();
    xsc.Add("urn: bookstore - schema", "books.xsd");
  }
}
using System;
using System;
using System.Xml;
using System.Xml.XPath;
using System.Xml.Xsl;

namespace TestForXslTransform{
  class Program{
    static void Main(string[] args){
      XslTransform xslt = new XslTransform();
      xslt.Load("https://server/favorite.xsl");
      XPathDocument mydata = new XPathDocument("inputdata.xml");
      XmlWriter writer = new XmlTextWriter(Console.Out);
      xslt.Transform(mydata, null, writer, null);
    }
  }
}

Requirements​