Vulnerable libraries

Libraries with a publicly known hole get found by searching for their version.

What it is

Pages load libraries such as jQuery, Bootstrap, Lodash or Angular. Versions of these libraries have published security advisories, and attackers search the web for sites that load exactly those versions.

Why it matters

A known hole turns a guess into a recipe. Running an old version of a library gives attackers a ready made path into your page. Tenty marks the finding likely, because the version comes from banners, file names or addresses and the use of the affected function stays unchecked.

How Tenty checks it

Tenty reads the version of each library from banners, CDN addresses, file names and package paths in your scripts, and matches it against a table of advisories generated from OSV. The finding names the library, the version and the advisory.

How to fix it

Upgrade the library to a version the advisory names as fixed. For libraries loaded from a CDN, change the address to the fixed version. Run your tests, since a major upgrade can change behaviour.

How to reproduce

curl -sS 'https://YOUR-APP/assets/app.js' | grep -o 'jQuery v[0-9.]*'

The version in the answer is the one Tenty matched.