---
title: "HOST-CVE-003 Vulnerability Snapshot Outdated or Test Data"
canonical: https://openvapt.com/checks/HOST-CVE-003.html
html: https://openvapt.com/checks/HOST-CVE-003.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-CVE-003 Vulnerability Snapshot Outdated or Test Data

Checks installed packages against an offline vulnerability snapshot.

- Domain: Server
- Severity: Low
- Control category: Patch and Vulnerability Management
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 7.3
- NIST CSF 2.0: ID.RA-01, PR.PS-02
- CWE: CWE-1104
- OWASP Top 10 2021: A06:2021
- NIST SP 800-53 Rev. 5: SI-2, RA-5

## Why It Matters

Known vulnerable package versions can expose a server to documented attacks.

## How It Detects

Reads installed package versions and matches OSV ecosystem ranges; each match names its matcher (exact version or range) and the snapshot date. When the binary carries only the test fixture snapshot (a source build without 'make vulndb'), the check reports Incomplete rather than Pass, because no advisory data was available.

## How to Fix

Install the vendor security update. For a source build, run 'make vulndb' to embed a snapshot generated from OSV and CISA KEV, then rebuild.

## How to Verify

```
Re-run OpenVAPT after patching and confirm the finding is absent.
```

## Learn the Theory

- [P10 Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities](https://openvapt.com/academy/p10.md)

## References

- [OSV vulnerability database](https://osv.dev/)
- [NVD](https://nvd.nist.gov/)
- [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/cve.go

Run it: `openvapt scan --only HOST-CVE-003`. Read it offline: `openvapt explain HOST-CVE-003`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-CVE-003.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.