The application does not make explicit the whole dependency tree it requires (direct and indirect third-party libraries) and their respective version.
- Accept a range of versions can cause a version of a dependency that is not supported by the application to be automatically installed.
- Install a dependency containing a known vulnerability and being unaware of it.
- Use a dependency version that is not compatible with the application.
All dependencies must be declared with a specific version and must be referenced with a dependency manager (npm, pip, maven). This allows to standardize the projects construction and packaging.
Anonymous attacker with access to the application.
⌚ 30 minutes.
Default score using CVSS 3.1. It may change depending on the context of the src.
Default score using CVSS 4.0. It may change depending on the context of the src.