QID 150545

Date Published: 2022-10-10

QID 150545: JavaScript Library Loaded via External Server

WAS will report out-of-scope JavaScript libraries discovered by the scanner during crawling and are provided in the Results section. Out-of-Scope means the link was not "in scope" per the Web Application configuration. The discovered libraries are reported only once based on the page on which they were first detected.

Each library is reported along with other information such as the URL of page on which it was first found, the version, and the URL of the .js file. Check results of QID 150176, if present, for the in-scope JavaScript libraries detected

When including third-party functionality, such as a JavaScript library, the application trust those libraries added. Without sufficient protection mechanisms, the functionality could be malicious in nature (i.e. either by coming from an untrusted source, being spoofed, or being modified in transit from a trusted source).

Solution

Use digital signatures or similar mechanisms to verify the software or data is from the expected source and has not been altered. Ensure libraries and dependencies, are consuming trusted repositories. If you have a higher risk profile, consider hosting an internal known-good repository that's vetted.

Vendor References

CVEs related to QID 150545

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].