CWE - CWE-1395: Dependency on Vulnerable Third-Party Component (4.16)

Weakness ID: 1395

Vulnerability Mapping: ALLOWED This CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review (with careful review of mapping notes)
Abstraction: Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.

View customized information:

For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.

Description

The product has a dependency on a third-party component that contains one or more known vulnerabilities.

Extended Description

Many products are large enough or complex enough that part of their functionality uses libraries, modules, or other intellectual property developed by third parties who are not the product creator. For example, even an entire operating system might be from a third-party supplier in some hardware products. Whether open or closed source, these components may contain publicly known vulnerabilities that could be exploited by adversaries to compromise the product.

Common Consequences

This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

Scope	Impact	Likelihood
Confidentiality Integrity Availability	Technical Impact: Varies by Context The consequences vary widely, depending on the vulnerabilities that exist in the component; how those vulnerabilities can be "reached" by adversaries, as the exploitation paths and attack surface will vary depending on how the component is used; and the criticality of the privilege levels and features for which the product relies on the component.

Potential Mitigations

Phases: Requirements; Policy

In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.

Phase: Requirements

Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].

Phases: Architecture and Design; Implementation; Integration; Manufacturing

Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."

Phases: Operation; Patching and Maintenance

Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.

Phases: Operation; Patching and Maintenance

Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.

Relationships

This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

Relevant to the view "Research Concepts" (CWE-1000)

Nature	Type	ID	Name
ChildOf	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	657	Violation of Secure Design Principles

Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

Phase	Note
Architecture and Design	The product architect or designer might choose a component that is already known to contain vulnerabilities or has a high likelihood of containing vulnerabilities in the future.
Implementation	For reasons of compatibility or stability, developers might choose a third-party component, such as a library, that is already known to contain vulnerabilities.
Patching and Maintenance	Since all products contain vulnerabilities, over time, a third-party component will be discovered to have a vulnerability.

Applicable Platforms

This listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

Class: Not Language-Specific (Undetermined Prevalence)

Operating Systems

Class: Not OS-Specific (Undetermined Prevalence)

Architectures

Class: Not Architecture-Specific (Undetermined Prevalence)

Technologies

Class: Not Technology-Specific (Undetermined Prevalence)

Demonstrative Examples

Example 1

The "SweynTooth" vulnerabilities in Bluetooth Low Energy (BLE) software development kits (SDK) were found to affect multiple Bluetooth System-on-Chip (SoC) manufacturers. These SoCs were used by many products such as medical devices, Smart Home devices, wearables, and other IoT devices. [REF-1314] [REF-1315]

Example 2

log4j, a Java-based logging framework, is used in a large number of products, with estimates in the range of 3 billion affected devices [REF-1317]. When the "log4shell" (CVE-2021-44228) vulnerability was initially announced, it was actively exploited for remote code execution, requiring urgent mitigation in many organizations. However, it was unclear how many products were affected, as Log4j would sometimes be part of a long sequence of transitive dependencies. [REF-1316]

Detection Methods

Automated Analysis

For software, use Software Composition Analysis (SCA) tools, which automatically analyze products to identify third-party dependencies. Often, SCA tools can be used to link with known vulnerabilities in the dependencies that they detect. There are commercial and open-source alternatives, such as OWASP Dependency-Check [REF-1312]. Many languages or frameworks have package managers with similar capabilities, such as npm audit for JavaScript, pip-audit for Python, govulncheck for Go, and many others. Dynamic methods can detect loading of third-party components.

Effectiveness: High

Note: Software Composition Analysis (SCA) tools face a number of technical challenges that can lead to false positives and false negatives. Dynamic methods have other technical challenges.

Memberships

This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	1418	Comprehensive Categorization: Violation of Secure Design Principles

Vulnerability Mapping Notes

Usage: ALLOWED-WITH-REVIEW

(this CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review)

Reason: Abstraction

Rationale:

This CWE entry is a Class and might have Base-level children that would be more appropriate

Comments:

Examine children of this entry to see if there is a better fit

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Mapped Node Name
ISA/IEC 62443	Part 4-2	Req CR 2.4
ISA/IEC 62443	Part 4-2	Req CR 6.2
ISA/IEC 62443	Part 4-2	Req CR 7.2
ISA/IEC 62443	Part 4-1	Req SM-9
ISA/IEC 62443	Part 4-1	Req SM-10
ISA/IEC 62443	Part 4-1	Req SR-2
ISA/IEC 62443	Part 4-1	Req DM-1
ISA/IEC 62443	Part 4-1	Req DM-3
ISA/IEC 62443	Part 4-1	Req DM-4
ISA/IEC 62443	Part 4-1	Req SVV-1
ISA/IEC 62443	Part 4-1	Req SVV-3

References

[REF-1313] Jeff Williams, Arshan Dabirsiaghi. "The Unfortunate Reality of Insecure Libraries". 2014. <https://owasp.org/www-project-dependency-check/>. URL validated: 2023-01-25.

[REF-1212] "A06:2021 - Vulnerable and Outdated Components". OWASP. 2021-09-24. <https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/>.

[REF-1247] NTIA Multistakeholder Process on Software Component Transparency Framing Working Group. "Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)". 2021-10-21. <https://www.ntia.gov/files/ntia/publications/ntia_sbom_framing_2nd_edition_20211021.pdf>.

[REF-1311] Amélie Koran, Wendy Nather, Stewart Scott, Sara Ann Brackett. "The Cases for Using the SBOMs We Build". 2022-11. <https://www.atlanticcouncil.org/wp-content/uploads/2022/11/AC_SBOM_IB_v2-002.pdf>. URL validated: 2023-01-25.

[REF-1312] OWASP. "OWASP Dependency-Check". <https://owasp.org/www-project-dependency-check/>. URL validated: 2023-01-25.

[REF-1314] ICS-CERT. "ICS Alert (ICS-ALERT-20-063-01): SweynTooth Vulnerabilities". 2020-03-04. <https://www.cisa.gov/news-events/ics-alerts/ics-alert-20-063-01>. URL validated: 2023-04-07.

[REF-1315] Matheus E. Garbelini, Sudipta Chattopadhyay, Chundong Wang, Singapore University of Technology and Design. "Unleashing Mayhem over Bluetooth Low Energy". 2020-03-04. <https://asset-group.github.io/disclosures/sweyntooth/>. URL validated: 2023-01-25.

[REF-1316] CISA. "Alert (AA21-356A): Mitigating Log4Shell and Other Log4j-Related Vulnerabilities". 2021-12-22. <https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a>. URL validated: 2023-04-07.

[REF-1317] SC Media. "What Log4Shell taught us about application security, and how to respond now". 2022-07-05. <https://www.scmagazine.com/resource/application-security/what-log4shell-taught-us-about-appsec-and-how-to-respond>. URL validated: 2023-01-26.

[REF-1320] Ali Youssef. "A Framework for a Medical Device Security Program at a Healthcare Delivery Organization". 2022-08-08. <https://array.aami.org/content/news/framework-medical-device-security-program-healthcare-delivery-organization>. URL validated: 2023-04-07.

[REF-1321] Cloud Security Alliance. "Shared Responsibility Model Explained". 2020-08-26. <https://cloudsecurityalliance.org/blog/2020/08/26/shared-responsibility-model-explained/>. URL validated: 2023-01-28.

[REF-1322] Melissa Chase, Steven Christey Coley, Julie Connolly, Ronnie Daldos, Margie Zuk. "Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook". Section 6.1: Medical Device Procurement. 2022-11-14. <https://www.mitre.org/news-insights/publication/medical-device-cybersecurity-regional-incident-preparedness-and-response>. URL validated: 2023-01-28.

Content History

Submissions
Submission Date	Submitter	Organization
2023-01-25 (CWE 4.10, 2023-01-31)	CWE Content Team	MITRE
2023-01-25 (CWE 4.10, 2023-01-31)
Contributions
Contribution Date	Contributor	Organization
2022-04-18	Samreen Arshad	Balochistan University of Information Technology, Engineering and Management Sciences
2022-04-18	Submitted a request for coverage of "Vulnerable and Outdated Components"
2023-06-29 (CWE 4.12, 2023-06-29)	"Mapping CWE to 62443" Sub-Working Group	CWE-CAPEC ICS/OT SIG
2023-06-29 (CWE 4.12, 2023-06-29)	Suggested mappings to ISA/IEC 62443.
Modifications
Modification Date	Modifier	Organization
2023-04-27	CWE Content Team	MITRE
2023-04-27	updated References, Relationships
2023-06-29	CWE Content Team	MITRE
2023-06-29	updated Mapping_Notes, Taxonomy_Mappings
2023-10-26	CWE Content Team	MITRE
2023-10-26	updated Demonstrative_Examples


	Site Map \| Terms of Use \| Manage Cookies \| Cookie Notice \| Privacy Policy \| Contact Us \| Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2024, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.

Common Weakness Enumeration

CWE-1395: Dependency on Vulnerable Third-Party Component

Edit Custom Filter