2277
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
CWE-1395: Dependency on Vulnerable Third-Party Component
Weakness ID : 1395
Structure : Simple
Abstraction : Class
Description
The product has a dependency on a third-party component that contains one or more known
vulnerabilities.
Extended Description
Many products are large enough or complex enough that part of their functionality uses libraries,
modules, or other intellectual property developed by third parties who are not the product creator.
For example, even an entire operating system might be from a third-party supplier in some
hardware products. Whether open or closed source, these components may contain publicly known
vulnerabilities that could be exploited by adversaries to compromise the product.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 657 Violation of Secure Design Principles 1446
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Varies by Context
The consequences vary widely, depending on the
vulnerabilities that exist in the component; how those
vulnerabilities can be "reached" by adversaries, as the
exploitation paths and attack surface will vary depending
on how the component is used; and the criticality of the
privilege levels and features for which the product relies on
the component.
Detection Methods
Automated Analysis
For software, use Software Composition Analysis (SCA) tools, which automatically analyze
products to identify third-party dependencies. Often, SCA tools can be used to link with known
vulnerabilities in the dependencies that they detect. There are commercial and open-source
CWE Version 4.14
CWE-1395: Dependency on Vulnerable Third-Party Component
CWE-1395: Dependency on Vulnerable Third-Party Component