Description

The application does not make explicit the whole dependency tree it requires (direct and indirect third-party libraries) and their respective version.

Impact

- Accept a range of versions can cause a version of a dependency that is not supported by the application to be automatically installed. - Install a dependency containing a known vulnerability and being unaware of it. - Use a dependency version that is not compatible with the application.

Recommendation

All dependencies must be declared with a specific version and must be referenced with a dependency manager (npm, pip, maven). This allows to standardize the projects construction and packaging.

Threat

Anonymous attacker with access to the application.

Expected Remediation Time

⏱️ 30 minutes.

Requirements

Fixes