endorlabs.comarticleOWASP OSS Risk 1: Known Vulnerabilities | Blog | Endor Labs
First in Endor Labs' 10-part series on the OWASP Top 10 OSS Risks, this piece breaks down "Known Vulnerabilities" (OSS-RISK-1): how CVEs get assigned and disclosed, why the 2017 Apache Struts CVE-2017-5638 unpatched flaw led to the Equifax breach of 145M+ records, and how to compare vulnerability data sources (NVD, GitHub Advisory Database, OSV). It details prioritization methods — CVSS, EPSS, CISA KEV, SSVC, and function-level reachability analysis — and shows a case study where filtering 134K findings down via reachability, fix-availability, production-code, and EPSS thresholds cut remediation work by 99.97%.
TL;DR Explainer on managing known OSS vulnerabilities (CVE lifecycle, NVD vs GHSA vs OSV, CVSS/EPSS/KEV/SSVC, reachability analysis) using the Equifax/Apache Struts breach as a cautionary tale.
Organisations named here
- Equifax
- SSVC
CVEs named here
- CVE-2017-5638
Technologies named here
- Apache Struts
- Endor Labs Vulnerability Database
- Endor Labs
- OWASP Dependency Check
- National Vulnerability Database
- GitHub Advisory Database
- Open Source Vulnerabilities
- Known Exploited Vulnerabilities Catalog
- Endor Labs Total Economic Impact calculator
- NVD
- OSV
- CVSS
- EPSS
- CISA KEV
Techniques named here
- Reachability analysis
- Dynamic analysis
- Static Analysis
- CVSS
- EPSS
- SSVC
- Remote code execution via crafted content types
Related in Supply Chain
