The Risky Component Detection feature for ARMS application security identifies risky third-party components in your applications. These components are dependencies that are not developed by your team, such as third-party dependency libraries referenced in Maven. For each risky component, the feature provides details including the associated CVE ID, component version, and path.
Using components with security vulnerabilities poses security risks to your application. We recommend that you fix risky components by upgrading them as soon as possible. If a fix is not immediately available, set the prevention mode of the application to Monitor and Block. This ensures that application security can intercept any attempts to exploit these vulnerabilities.
Procedure
-
Log in to the ARMS console.
-
In the left-side navigation pane, choose . Then, in the top menu bar, select a region.
By default, the Risky Components page displays the number of vulnerabilities found in the risky components across all applications.
-
Optional: To view the detection results for a specific application, do one of the following:
-
Click the All Applications drop-down menu at the top of the Risky Components page and select a specific application.
-
On the page, click the number in the Risky Components column for an application. This action takes you to the Risky Components page, which displays the detection results for that application.
-
View risky component details
The Risky Component Detection tab summarizes the vulnerabilities found in risky components. For each vulnerability, it lists the CVE ID, vulnerability severity, vulnerability score, and the version and path of the affected component. You can use the filter box to search for vulnerabilities by component path, CVE ID, or vulnerability severity.
You can also click View in the Details column for a vulnerability to open a panel with details about the vulnerability and its associated components and instances.
Full component auto-detection
While the Risky Component Detection tab lists components with known vulnerabilities and CVE IDs, the Full Component Auto-detection tab provides a complete inventory of every third-party component in your applications with application security enabled. This allows you to quickly search for components related to newly discovered vulnerabilities. The Full Component Auto-detection tab displays a list of all third-party components for the current application. You can filter this list by component path or search for components by keyword. The list includes the component path, component name, component version, and instance count columns. To view more details, click View in the Details column.