According to Gartner, up to 45% of organizations worldwide would have experienced an attack on their software supply chain by 2025. Software supply chain vulnerabilities such as log4j continued to impact 41% of organizations as of October 2022, many months after it was discovered.
Your online website may contain 1st party (local to web server or domain), 3rd party(outside organization’s domain) or even 4th party scripts (activated by 3rd party scripts). Any single vulnerability to any of these scripts can severely impact functionality and look-and-feel of the website.
PCI DSS v4 Clause 6.3.2 requires an inventory of bespoke and custom software and third-party components to be maintained. PCI DSS v4 Clause 6.4.2 requires payment page scripts to be justified in an inventory too.
