OpenVAPTHighWEB-CVE-001Patch and Vulnerability ManagementWeb Apps
Vulnerable Web Application Libraries
Matches local web library versions against offline OSV advisories; WordPress core is inventoried and reported Incomplete because OSV publishes no WordPress feed.
- Why It Matters
- Unpatched web libraries can expose users and server data to known vulnerabilities.
- How It Detects
- Reads lockfiles (Packagist composer.lock, npm package-lock.json, PyPI poetry.lock, Pipfile.lock and exact pins in requirements.txt, RubyGems Gemfile.lock, Go go.mod and crates.io Cargo.lock; only package names and versions are kept), wp-includes/version.php (inventoried as WordPress:Core; OSV publishes no WordPress export, so a real snapshot has no data for it) and jQuery file headers under configured document roots, and matches them against the snapshot. Each match names its matcher: exact version, range, or heuristic for a version read from a file header. Inventory the snapshot has no advisory data for (for example WordPress core, for which OSV publishes no feed, or the test fixture snapshot of a source build) is reported Incomplete, never Pass.
- How to Fix
- Update the affected library or WordPress core and deploy a refreshed lockfile or asset. For a source build, run 'make vulndb' to embed a generated snapshot.
- How to Verify
Re-run OpenVAPT and verify that the vulnerable version is no longer deployed.- CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Control Category
- Patch and Vulnerability Management: CIS Controls v8 7, 2; NIST CSF 2.0 ID.RA, PR.PS
- Fix Effort
- Medium
- CIS Controls v8 Safeguard
- 7.4
- NIST CSF 2.0 Subcategory
- ID.RA-01, PR.PS-02
- CWE
- CWE-1104
- OWASP Top 10
- A06:2021
- OWASP ASVS 4.0.3
- 14.2.1
- NIST SP 800-53 Rev. 5
- SI-2, RA-5
- References
- OSV
OSV schema, defined ecosystems (WordPress)
NVD
Learn the theory behind this check: P10 Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities, A7 Security Testing in Agile Teams and CI.
Source Code
The complete file that defines this check. Run it with openvapt scan --only WEB-CVE-001, or read it offline with openvapt explain WEB-CVE-001.
internal/checks/web/cve.go · Lines 1-63View on GitHub at This Commit
| 1 | package web |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "fmt" |
| 6 | "strings" |
| 7 | |
| 8 | "github.com/openvapt/openvapt/internal/check" |
| 9 | "github.com/openvapt/openvapt/internal/checks/collect" |
| 10 | "github.com/openvapt/openvapt/internal/sys" |
| 11 | ) |
| 12 | |
| 13 | func init() { |
| 14 | check.Register(&check.Check{ |
| 15 | ID: "WEB-CVE-001", |
| 16 | Title: "Vulnerable Web Application Libraries", |
| 17 | Domain: check.DomainWeb, |
| 18 | Severity: check.High, |
| 19 | Category: check.CatPatch, |
| 20 | Effort: check.EffortMedium, |
| 21 | CVSS: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", |
| 22 | Summary: "Matches local web library versions against offline OSV advisories; WordPress core is inventoried and reported Incomplete because OSV publishes no WordPress feed.", |
| 23 | Rationale: "Unpatched web libraries can expose users and server data to known vulnerabilities.", |
| 24 | Detection: "Reads lockfiles (Packagist composer.lock, npm package-lock.json, PyPI poetry.lock, Pipfile.lock and exact pins in requirements.txt, RubyGems Gemfile.lock, Go go.mod and crates.io Cargo.lock; only package names and versions are kept), wp-includes/version.php (inventoried as WordPress:Core; OSV publishes no WordPress export, so a real snapshot has no data for it) and jQuery file headers under configured document roots, and matches them against the snapshot. Each match names its matcher: exact version, range, or heuristic for a version read from a file header. Inventory the snapshot has no advisory data for (for example WordPress core, for which OSV publishes no feed, or the test fixture snapshot of a source build) is reported Incomplete, never Pass.", |
| 25 | Fix: "Update the affected library or WordPress core and deploy a refreshed lockfile or asset. For a source build, run 'make vulndb' to embed a generated snapshot.", |
| 26 | Verify: "Re-run OpenVAPT and verify that the vulnerable version is no longer deployed.", |
| 27 | Refs: []check.Ref{{Title: "OSV", URL: "https://osv.dev/"}, {Title: "OSV schema, defined ecosystems (WordPress)", URL: "https://ossf.github.io/osv-schema/"}, {Title: "NVD", URL: "https://nvd.nist.gov/"}}, |
| 28 | Standards: check.Standards{CWE: []string{"CWE-1104"}, OWASP: []string{"A06:2021"}, NIST: []string{"SI-2", "RA-5"}}, |
| 29 | Run: func(ctx context.Context, s sys.System) []check.Result { |
| 30 | db, e := collect.VulnDB(ctx, s) |
| 31 | if e != nil { |
| 32 | return []check.Result{check.IncompleteR("web inventory", "Snapshot could not be read")} |
| 33 | } |
| 34 | if db.Header.Fixture { |
| 35 | return []check.Result{check.IncompleteR("web inventory", "No advisory data: the embedded snapshot is test fixture data", collect.FixtureNotice, db.Notice())} |
| 36 | } |
| 37 | items, ok := collect.WebInventory(ctx, s) |
| 38 | if !ok { |
| 39 | return []check.Result{check.IncompleteR("web inventory", "Web libraries could not be fully inventoried", db.Notice())} |
| 40 | } |
| 41 | var out []check.Result |
| 42 | uncovered := map[string]bool{} |
| 43 | for _, p := range items { |
| 44 | eco := strings.SplitN(p.Ecosystem, ":", 2)[0] |
| 45 | if !db.HasEcosystem(eco) { |
| 46 | uncovered[eco] = true |
| 47 | continue |
| 48 | } |
| 49 | for _, m := range db.Match(p.Ecosystem, p.Package, p.Version) { |
| 50 | a := m.Advisory |
| 51 | out = append(out, check.FailR(p.Package, fmt.Sprintf("%s %s: %s (%s), severity %s", p.Package, p.Version, a.ID, strings.Join(a.Aliases, ", "), a.Severity), "matcher: "+p.Matcher(m.Matcher), "source: "+p.Path, db.Notice())) |
| 52 | } |
| 53 | } |
| 54 | for eco := range uncovered { |
| 55 | out = append(out, check.IncompleteR(eco+" inventory", "No "+eco+" advisory data in snapshot; "+eco+" components were inventoried but could not be matched", db.Notice())) |
| 56 | } |
| 57 | if len(out) == 0 { |
| 58 | return []check.Result{check.PassR("web inventory", "No matching advisories in the embedded snapshot", db.Notice())} |
| 59 | } |
| 60 | return out |
| 61 | }, |
| 62 | }) |
| 63 | } |
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
APA 7
OpenVAPT. (2026). WEB-CVE-001 Vulnerable Web Application Libraries (Version 0.1.0-alpha.6). OpenVAPT Check Catalogue. Retrieved October 16, 2026, from https://openvapt.com/checks/WEB-CVE-001.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
BibTeX
@misc{openvapt_web_cve_001,
author = {{OpenVAPT}},
title = {{WEB-CVE-001 Vulnerable Web Application Libraries}},
year = {2026},
howpublished = {\url{https://openvapt.com/checks/WEB-CVE-001.html}},
note = {OpenVAPT Check Catalogue, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.