A library admin UI ships a years-outdated JavaScript library known for client-side vulnerability classes. What should the tester emphasize?
Select an answer to reveal the explanation.
Short Explanation
Driving a car with decade-old airbags is a maintenance problem with security teeth. Ancient admin JS libraries can open client-side vuln classes — track them and patch. HTTPS on the API does not retire old browser code, and this is not an AD Domain Admin cheat code.
Full Explanation
A library admin UI that ships a years-outdated JavaScript library known for client-side vulnerability classes should be inventoried and updated: stale front-end components can enable XSS-assist and related browser-side risk even when the API uses HTTPS.
Old jQuery (or similar) versions are not limited to print stylesheet issues. Front-end library age remains security-relevant under HTTPS because transport encryption does not patch DOM XSS sinks. Outdated JS libraries do not automatically grant Domain Admin on Active Directory—that conflates web client risk with AD privilege.
Exam caveat: SCA findings need reachability and context; still flag known-bad client libraries in privileged admin UIs with honest severity.
Operational check: inventory script libraries and versions on the admin UI, map known vulnerability classes, and recommend patching or replacement. Include the library bill of materials in the library's remediation backlog for civic admin applications. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.