V-288289

Discussion

Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.

Check Content

Review the application documentation and deployed configuration to determine whether the application removes organization-defined software components after updated versions have been installed.

If the application does not remove organization-defined software components after updated versions have been installed, this is a finding.