CKONDURU100522 (Community Member) asked a question.
Getting CWE ID 80 error for the below 3rd party dlls.
microsoft.crm.core.dll
system.web.http.webhost.dll
dotnetopenauth.core.dll
microsoft.identitymodel.dll
microsoft.xrm.portal.Dll
Could you pleas help us in addressing these issues ?
microsoft.crm.core.dll
system.web.http.webhost.dll
dotnetopenauth.core.dll
microsoft.identitymodel.dll
microsoft.xrm.portal.Dll
Could you pleas help us in addressing these issues ?
we are referring these external dlls in our application and we are getting CWE ID 80 issue in Static Scan. Can you please help how to fix these issues
.png){kind=logo}
Hi @CKONDURU100522 (Community Member) ,
Great question! Veracode Static Analysis reports flaws in known 3rd party DLLs when they are selected as entry points. Selecting them as entry points tells our engine that an external user can directly interact with them. Since they are libraries this seems unlikely and you might want to consider reviewing your module selection. If you want to know about modules are and how your results change based on what you select as entry points, I recommend checking out the following knowledge article: https://community.veracode.com/s/article/What-are-Modules-and-how-do-my-results-change-based-on-what-I-select .
Please do note that 3rd software, still means 1st party risk. If you are building a house and use 3rd wooden planks that turn out to be rotten or you're using them incorrectly (bearing too much weight) it will still be *your house* that collapses on *you*. If you are aware of flaws in 3rd party software that you are relying on we recommend you work with the vendor to get the flaws remediated.
Thank you,
Florian Walter