Let's say I have a project structure that looks like the one below (comprised of multiple sub-modules, each with its own pom file):
Let's say the only module that gets deployed to production (as a WAR file) is web-service. Inside this WAR file (I can peek into the contents using something like 7zip), there is a WEB-INF/lib/ directory containing all dependencies that will be deployed to production. Is it at all possible for the application to be vulnerable to dependencies declared in the other pom files that aren't what's deployed to production (let's say the WAR file does not contain a vulnerable dependency that is declared in the other modules' pom files - is the application still vulnerable?).