Every modern application is assembled from pieces it did not write itself — web frameworks, content-management systems, image-processing libraries, authentication modules, and dozens of other off-the-shelf components. That is completely normal and unavoidable. The problem arises when one of those components contains a known security flaw and nobody updates it.
What does "known vulnerability" mean?
When a security researcher discovers a flaw in a piece of software, they report it. The flaw receives a unique identifier called a CVE (Common Vulnerabilities and Exposures number) that looks like this:
CVE-2023-41337The number contains the year the CVE was assigned and a sequence number. Once you start researching CVEs, you will see a few related terms again and again:
| Term | What it means | Why it matters |
|---|---|---|
| CVE | Common Vulnerabilities and Exposures identifier, such as CVE-2023-41337 | Gives everyone one shared name for the same vulnerability |
| CNA | CVE Numbering Authority | Organization authorized to assign CVEs for a product or ecosystem |
| NVD | National Vulnerability Database, maintained by NIST | Adds severity scores, affected-version data, weakness categories, and references |
| CVSS | Common Vulnerability Scoring System | Rates severity from 0.0 to 10.0 so teams can prioritize fixes |
| CWE | Common Weakness Enumeration | Describes the underlying bug class, such as hardcoded credentials or SQL injection |
| CPE | Common Platform Enumeration | Standardized product and version naming used to match CVEs to software |
These terms show up constantly in professional vulnerability research. A CVE ID tells you which vulnerability people are discussing. NVD enriches that record with scoring and affected products. CVSS helps rank urgency. CWE tells you what kind of coding or design mistake caused the issue. CPE helps scanners and asset inventories decide whether a specific installed product matches the vulnerable software.
Where researchers look
A CVSS score (Common Vulnerability Scoring System) rates severity from 0.0 to 10.0. Anything above 9.0 is CRITICAL — it typically means an attacker can exploit the flaw remotely, without authentication, and gain significant access.
Different sources answer different questions:
| Source | Best for | Important caution |
|---|---|---|
| Vendor advisory | The official patch, affected versions, mitigation steps, and upgrade guidance | Usually the most authoritative source for remediation |
| NVD | Standardized CVE record, CVSS score, CWE category, references, and affected products | NVD tells you severity and scope, but usually does not teach exploitation step by step |
| ExploitDB | Public proof-of-concept exploits and practical exploit notes | A PoC may be incomplete, version-specific, unsafe to run, or written for a slightly different environment |
| SearchSploit | Command-line search over ExploitDB entries | Useful on Kali or a pentest VM when you want to search offline |
| CVEDetails | Browsing CVEs by vendor, product, version, or year | Convenient for discovery, but verify details against NVD and vendor advisories |
| Security blogs / GitHub | Early analysis, detection rules, scanners, and reproduction notes | Quality varies; confirm claims before relying on them in a report |
Attackers and defenders often read the same sources. The difference is the goal: the attacker asks, "Can I use this to get access?" The defender asks, "Where is this software running, and how fast can we patch or mitigate it?"
How to research a known vulnerability
A practical workflow looks like this:
- Identify the product and version:
NovaBlog CMS v3.7.2. - Search for the product and version in NVD, CVEDetails, vendor advisories, or ExploitDB.
- Confirm the affected version range: for example, "all versions below 4.0.0."
- Read the impact: remote code execution, authentication bypass, data disclosure, privilege escalation, denial of service, and so on.
- Check exploit conditions: does the attacker need an account, a specific plugin, a reachable endpoint, or a special configuration?
- For remediation, prefer the vendor patch or upgrade guidance over random exploit notes.
How attackers use these databases
Once a CVE is published, attackers search ExploitDB for the exact product and version running on a target. If the target has not applied the patch, the vulnerability is still there — even though a fix exists and has been publicly documented.
This is why the attack class is called "using components with known vulnerabilities": the word known is doing real work. The vulnerability is not a secret zero-day. The patch exists. The attacker is simply counting on the defender having skipped the update.
Real-world scale
This attack class has produced some of the most damaging breaches in history:
- Log4Shell (CVE-2021-44228) — a critical flaw in the Apache Log4j logging library used by millions of Java applications worldwide. Within 72 hours of public disclosure, attackers were scanning the entire internet for vulnerable systems. Companies ranging from cloud providers to video-game servers were exploited.
- Equifax breach (2017) — attackers exploited CVE-2017-5638, a remote code execution flaw in Apache Struts 2 that had a patch available for two months before the breach. The result: 147 million people had their personal and financial data stolen.
- Spring4Shell (CVE-2022-22965) — a critical RCE in the Spring Framework, one of the most widely used Java development frameworks. Thousands of production systems were vulnerable because updates had not been applied.
OWASP ranks this category as A06:2021 — Vulnerable and Outdated Components in the OWASP Top 10.
What you will do in this lesson
You will attack a purpose-built practice application called NovaBlog CMS v3.7.2 — a fictional content-management system deliberately running a version with a documented CVE.
Your attack path follows exactly what a real attacker does:
- Fingerprint the software — identify the product name and version number displayed on the running application.
- Research the CVE — read what the vulnerability is and what information the published exploit provides.
- Exploit — use the information from the CVE advisory to authenticate to a privileged endpoint that should not be publicly accessible.
- Capture the flag — retrieve the challenge flag from the exposed configuration dump.
Everything happens in your browser. No tools to install.