Use of Unmaintained Third Party Components

Opis

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

Skutki

• Other

  Reduce Maintainability; Varies by Context

  Relying on unmaintained components makes it difficult or impossible to fix significant bugs and vulnerabilities, can render code obsolete, and undermine security by complicating maintenance and increasing the risk of new vulnerabilities.

Przykłady podatności

• CVE-2025-40906 Perl module for BSON serialization includes a component that reached end-of-life approximately five years previously, but has multiple vulnerabilities.
• CVE-2024-35252 Closed-source cloud storage product includes an unmaintained third-party component that allows denial of service

Słabość nadrzędna

• CWE-1357 Reliance on Insufficiently Trustworthy Component

Kiedy powstaje

• Architecture and Design

Dotyczy

Not Language-Specific, Not Technology-Specific, ICS/OT

Źródła

1. A06:2021 - Vulnerable and Outdated Components — OWASP, 2021