Owasp Infrastructure

# 00 Vulnerability Index

This document provides the index for the OWASP Infrastructure Security Top 10 (2024) vulnerabilities.
Each entry includes its identifier, title, and primary category.

## Vulnerability catalog

| ID         | Title                                                   | Category                 |
|------------|---------------------------------------------------------|--------------------------|
| ISR01:2024 | Outdated Software                                       | Patch Management         |
| ISR02:2024 | Insufficient Threat Detection                           | Observability            |
| ISR03:2024 | Insecure Configurations                                 | Configuration Management |
| ISR04:2024 | Insecure Resource and User Management                   | Access Control           |
| ISR05:2024 | Insecure Use of Cryptography                            | Data Protection          |
| ISR06:2024 | Insecure Network Access Management                      | Network Security         |
| ISR07:2024 | Insecure Authentication Methods and Default Credentials | Credential Hygiene       |
| ISR08:2024 | Information Leakage                                     | Data Protection          |
| ISR09:2024 | Insecure Access to Resources and Management Components  | Access Control           |
| ISR10:2024 | Insufficient Asset Management and Documentation         | Governance               |

## Cross-reference matrix

Each vulnerability document follows a consistent structure:

1. Description — what the vulnerability is and how it manifests in internal infrastructure.
2. Risk — concrete consequences of exploitation and business impact.
3. Vulnerability checklist — indicators that the environment is exposed.
4. Prevention controls — defensive measures and rectification steps.
5. Example attack scenarios — realistic exploitation narratives.
6. Detection guidance — signals and methods to identify exposure.
7. Remediation — immediate and long-term actions to contain and resolve.

## Category groupings

### Patch Management

* ISR01:2024 Outdated Software

### Observability

* ISR02:2024 Insufficient Threat Detection

### Configuration Management

* ISR03:2024 Insecure Configurations

### Access Control

* ISR04:2024 Insecure Resource and User Management
* ISR09:2024 Insecure Access to Resources and Management Components

### Data Protection

* ISR05:2024 Insecure Use of Cryptography
* ISR08:2024 Information Leakage

### Network Security

* ISR06:2024 Insecure Network Access Management

### Credential Hygiene

* ISR07:2024 Insecure Authentication Methods and Default Credentials

### Governance

* ISR10:2024 Insufficient Asset Management and Documentation

---

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*


---
title: 'ISR01: Outdated Software'
description: OWASP Infrastructure Top 10 reference for outdated software vulnerabilities including unpatched systems and end-of-life components
---

# 01 Outdated Software

Identifier: ISR01:2024
Category: Patch Management

## Description

Outdated software occurs when software components, including libraries and dependencies, are not
kept on current, stable, and supported versions.
Updates frequently include security-relevant patches, meaning unpatched software may contain
vulnerabilities in its current version state.
These vulnerabilities are often publicly known and can be discovered by security scanners.
Due to the lack of updates and update management, many software components and underlying systems
become vulnerable over time, with increasing criticality as time passes.

## Risk

* Vulnerabilities ranging from low criticality to full system compromise.
* Severity and count of vulnerabilities in