CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
A web application uses a JavaScript library with a known critical vulnerability (CVE). What OWASP Top 10 category does this fall under?
- A.A. Injection
- B.C. Broken Access Control
- C.B. Vulnerable and Outdated Components
- D.D. CSRF
Why C is correct
Using components (libraries, frameworks, plugins) with known vulnerabilities is a critical risk. Attackers scan for known CVEs and exploit them in applications using vulnerable versions. Mitigations: maintain a Software Bill of Materials (SBOM), use dependency scanning tools (Snyk, Dependabot), and patch/update promptly.
Know someone studying for Security Fundamentals? Send them this one.