CAPEC Definitions

    CAPEC Definitions / CAPEC-538

    CAPEC-538: Open-Source Library Manipulation

    Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.

    Severity:High
    Possibility:Low

    Extended Description

    No Extended Description.

    Mitigations

    No Mitigations found.

    Relationships with other CAPECs

    CAPEC-444: Development Alteration

    Details

    Prerequisites

    Access to the open source code base being used by the manufacturer in a system being developed or currently deployed at a victim location.

    Related Weaknesses

    CWE-494: Download of Code Without Integrity Check

    Details

    CWE-829: Inclusion of Functionality from Untrusted Control Sphere

    Details