CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
A web application uses a JavaScript library with a known critical vulnerability (CVE). What OWASP Top 10 category does this fall under?
- A.Broken Access Control, since a web application firewall removes the need for secure coding entirely
- B.Vulnerable and Outdated Components
- C.CSRF
- D.Injection
Why B is correct
Using components (libraries, frameworks, plugins) with known vulnerabilities is a critical risk. Attackers scan for known CVEs and exploit them in applications using vulnerable versions. Mitigations: maintain a Software Bill of Materials (SBOM), use dependency scanning tools (Snyk, Dependabot), and patch/update promptly.
Know someone studying for Security Fundamentals? Send them this one.