CWE

Common Weakness Enumeration

A Community-Developed List of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (2.10)  
ID

CWE VIEW: Weaknesses in OWASP Top Ten (2007)

Mapping-Friendly:
View ID: 629
Structure: Graph
Status: Draft
Presentation Filter:
+ View Data

View Objective

CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2007.

+ View Audience
StakeholderDescription
Developers

This view outlines the most important issues as identified by the OWASP Top Ten (2007 version), providing a good starting point for web application developers who want to code more securely.

Software_Customers

This view outlines the most important issues as identified by the OWASP Top Ten (2007 version), providing customers with a way of asking their software developers to follow minimum expectations for secure code.

Educators

Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

+ Relationships
629 - Weaknesses in OWASP Top Ten (2007)
+CategoryCategoryOWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS) - (712)
629 (Weaknesses in OWASP Top Ten (2007)) > 712 (OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS))
Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2007.
*Weakness BaseWeakness BaseImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - (79)
629 (Weaknesses in OWASP Top Ten (2007)) > 712 (OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)) > 79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.XSSCSS
+CategoryCategoryOWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access - (721)
629 (Weaknesses in OWASP Top Ten (2007)) > 721 (OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access)
Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2007.
*Weakness BaseWeakness BaseAuthentication Bypass Using an Alternate Path or Channel - (288)
629 (Weaknesses in OWASP Top Ten (2007)) > 721 (OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access) > 288 (Authentication Bypass Using an Alternate Path or Channel)
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
*Weakness BaseWeakness BaseDirect Request ('Forced Browsing') - (425)
629 (Weaknesses in OWASP Top Ten (2007)) > 721 (OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access) > 425 (Direct Request ('Forced Browsing'))
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.forced browsing
*Weakness ClassWeakness ClassImproper Authorization - (285)
629 (Weaknesses in OWASP Top Ten (2007)) > 721 (OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access) > 285 (Improper Authorization)
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.AuthZ
+CategoryCategoryOWASP Top Ten 2007 Category A2 - Injection Flaws - (713)
629 (Weaknesses in OWASP Top Ten (2007)) > 713 (OWASP Top Ten 2007 Category A2 - Injection Flaws)
Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2007.
*Weakness BaseWeakness BaseImproper Neutralization of CRLF Sequences ('CRLF Injection') - (93)
629 (Weaknesses in OWASP Top Ten (2007)) > 713 (OWASP Top Ten 2007 Category A2 - Injection Flaws) > 93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
*Weakness ClassWeakness ClassImproper Neutralization of Special Elements used in a Command ('Command Injection') - (77)
629 (Weaknesses in OWASP Top Ten (2007)) > 713 (OWASP Top Ten 2007 Category A2 - Injection Flaws) > 77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
*Weakness BaseWeakness BaseImproper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') - (90)
629 (Weaknesses in OWASP Top Ten (2007)) > 713 (OWASP Top Ten 2007 Category A2 - Injection Flaws) > 90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))
The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
*Weakness BaseWeakness BaseImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - (89)
629 (Weaknesses in OWASP Top Ten (2007)) > 713 (OWASP Top Ten 2007 Category A2 - Injection Flaws) > 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
*Weakness BaseWeakness BaseXML Injection (aka Blind XPath Injection) - (91)
629 (Weaknesses in OWASP Top Ten (2007)) > 713 (OWASP Top Ten 2007 Category A2 - Injection Flaws) > 91 (XML Injection (aka Blind XPath Injection))
The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
+CategoryCategoryOWASP Top Ten 2007 Category A3 - Malicious File Execution - (714)
629 (Weaknesses in OWASP Top Ten (2007)) > 714 (OWASP Top Ten 2007 Category A3 - Malicious File Execution)
Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2007.
*Weakness BaseWeakness BaseImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') - (98)
629 (Weaknesses in OWASP Top Ten (2007)) > 714 (OWASP Top Ten 2007 Category A3 - Malicious File Execution) > 98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'))
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.Remote file includeRFILocal file inclusion
*Weakness BaseWeakness BaseImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') - (95)
629 (Weaknesses in OWASP Top Ten (2007)) > 714 (OWASP Top Ten 2007 Category A3 - Malicious File Execution) > 95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'))
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
*Weakness BaseWeakness BaseImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - (78)
629 (Weaknesses in OWASP Top Ten (2007)) > 714 (OWASP Top Ten 2007 Category A3 - Malicious File Execution) > 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Shell injectionShell metacharacters
*Weakness BaseWeakness BaseUnrestricted Upload of File with Dangerous Type - (434)
629 (Weaknesses in OWASP Top Ten (2007)) > 714 (OWASP Top Ten 2007 Category A3 - Malicious File Execution) > 434 (Unrestricted Upload of File with Dangerous Type)
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.Unrestricted File Upload
+CategoryCategoryOWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference - (715)
629 (Weaknesses in OWASP Top Ten (2007)) > 715 (OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference)
Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2007.
*Weakness BaseWeakness BaseAuthorization Bypass Through User-Controlled Key - (639)
629 (Weaknesses in OWASP Top Ten (2007)) > 715 (OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference) > 639 (Authorization Bypass Through User-Controlled Key)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.Insecure Direct Object ReferenceHorizontal Authorization
*Weakness BaseWeakness BaseExternal Control of Assumed-Immutable Web Parameter - (472)
629 (Weaknesses in OWASP Top Ten (2007)) > 715 (OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference) > 472 (External Control of Assumed-Immutable Web Parameter)
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.Assumed-Immutable Parameter Tampering
*Weakness ClassWeakness ClassImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - (22)
629 (Weaknesses in OWASP Top Ten (2007)) > 715 (OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference) > 22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Directory traversalPath traversal
+CategoryCategoryOWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF) - (716)
629 (Weaknesses in OWASP Top Ten (2007)) > 716 (OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF))
Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2007.
+Compound Element: CompositeCompound Element: CompositeCross-Site Request Forgery (CSRF) - (352)
629 (Weaknesses in OWASP Top Ten (2007)) > 716 (OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)) > 352 (Cross-Site Request Forgery (CSRF))
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Session RidingCross Site Reference ForgeryXSRF
*Weakness ClassWeakness ClassExternal Control of Critical State Data - (642)
629 (Weaknesses in OWASP Top Ten (2007)) > 716 (OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)) > 352 (Cross-Site Request Forgery (CSRF)) > 642 (External Control of Critical State Data)
The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.
*Weakness BaseWeakness BaseInsufficient Session Expiration - (613)
629 (Weaknesses in OWASP Top Ten (2007)) > 716 (OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)) > 352 (Cross-Site Request Forgery (CSRF)) > 613 (Insufficient Session Expiration)
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
*Weakness BaseWeakness BaseOrigin Validation Error - (346)
629 (Weaknesses in OWASP Top Ten (2007)) > 716 (OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)) > 352 (Cross-Site Request Forgery (CSRF)) > 346 (Origin Validation Error)
The software does not properly verify that the source of data or communication is valid.
*Weakness ClassWeakness ClassUnintended Proxy or Intermediary ('Confused Deputy') - (441)
629 (Weaknesses in OWASP Top Ten (2007)) > 716 (OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)) > 352 (Cross-Site Request Forgery (CSRF)) > 441 (Unintended Proxy or Intermediary ('Confused Deputy'))
The software receives a request, message, or directive from an upstream component, but the software does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the software's control sphere. This causes the software to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.Confused Deputy
+CategoryCategoryOWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling - (717)
629 (Weaknesses in OWASP Top Ten (2007)) > 717 (OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling)
Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2007.
*Weakness ClassWeakness ClassInformation Exposure - (200)
629 (Weaknesses in OWASP Top Ten (2007)) > 717 (OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling) > 200 (Information Exposure)
An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.Information LeakInformation Disclosure
*Weakness VariantWeakness VariantInformation Exposure Through Debug Information - (215)
629 (Weaknesses in OWASP Top Ten (2007)) > 717 (OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling) > 215 (Information Exposure Through Debug Information)
The application contains debugging code that can expose sensitive information to untrusted parties.
*Weakness ClassWeakness ClassInformation Exposure Through Discrepancy - (203)
629 (Weaknesses in OWASP Top Ten (2007)) > 717 (OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling) > 203 (Information Exposure Through Discrepancy)
The product behaves differently or sends different responses in a way that exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
*Weakness BaseWeakness BaseInformation Exposure Through an Error Message - (209)
629 (Weaknesses in OWASP Top Ten (2007)) > 717 (OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling) > 209 (Information Exposure Through an Error Message)
The software generates an error message that includes sensitive information about its environment, users, or associated data.
+CategoryCategoryOWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management - (718)
629 (Weaknesses in OWASP Top Ten (2007)) > 718 (OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management)
Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2007.
*Weakness ClassWeakness ClassImproper Authentication - (287)
629 (Weaknesses in OWASP Top Ten (2007)) > 718 (OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management) > 287 (Improper Authentication)
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.authentificationAuthC
*Weakness BaseWeakness BaseInsufficiently Protected Credentials - (522)
629 (Weaknesses in OWASP Top Ten (2007)) > 718 (OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management) > 522 (Insufficiently Protected Credentials)
This weakness occurs when the application transmits or stores authentication credentials and uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
*Weakness VariantWeakness VariantReflection Attack in an Authentication Protocol - (301)
629 (Weaknesses in OWASP Top Ten (2007)) > 718 (OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management) > 301 (Reflection Attack in an Authentication Protocol)
Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user.
+CategoryCategoryOWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage - (719)
629 (Weaknesses in OWASP Top Ten (2007)) > 719 (OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage)
Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2007.
*Weakness ClassWeakness ClassInadequate Encryption Strength - (326)
629 (Weaknesses in OWASP Top Ten (2007)) > 719 (OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage) > 326 (Inadequate Encryption Strength)
The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
*Weakness BaseWeakness BaseMissing Encryption of Sensitive Data - (311)
629 (Weaknesses in OWASP Top Ten (2007)) > 719 (OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage) > 311 (Missing Encryption of Sensitive Data)
The software does not encrypt sensitive or critical information before storage or transmission.
*Weakness BaseWeakness BaseMissing Required Cryptographic Step - (325)
629 (Weaknesses in OWASP Top Ten (2007)) > 719 (OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage) > 325 (Missing Required Cryptographic Step)
The software does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by that algorithm.
*Weakness BaseWeakness BaseUse of Hard-coded Cryptographic Key - (321)
629 (Weaknesses in OWASP Top Ten (2007)) > 719 (OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage) > 321 (Use of Hard-coded Cryptographic Key)
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
+CategoryCategoryOWASP Top Ten 2007 Category A9 - Insecure Communications - (720)
629 (Weaknesses in OWASP Top Ten (2007)) > 720 (OWASP Top Ten 2007 Category A9 - Insecure Communications)
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2007.
*Weakness ClassWeakness ClassInadequate Encryption Strength - (326)
629 (Weaknesses in OWASP Top Ten (2007)) > 720 (OWASP Top Ten 2007 Category A9 - Insecure Communications) > 326 (Inadequate Encryption Strength)
The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
*Weakness BaseWeakness BaseMissing Encryption of Sensitive Data - (311)
629 (Weaknesses in OWASP Top Ten (2007)) > 720 (OWASP Top Ten 2007 Category A9 - Insecure Communications) > 311 (Missing Encryption of Sensitive Data)
The software does not encrypt sensitive or critical information before storage or transmission.
*Weakness BaseWeakness BaseMissing Required Cryptographic Step - (325)
629 (Weaknesses in OWASP Top Ten (2007)) > 720 (OWASP Top Ten 2007 Category A9 - Insecure Communications) > 325 (Missing Required Cryptographic Step)
The software does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by that algorithm.
*Weakness BaseWeakness BaseUse of Hard-coded Cryptographic Key - (321)
629 (Weaknesses in OWASP Top Ten (2007)) > 720 (OWASP Top Ten 2007 Category A9 - Insecure Communications) > 321 (Use of Hard-coded Cryptographic Key)
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
+ Relationship Notes

The relationships in this view are a direct extraction of the CWE mappings that are in the 2007 OWASP document. CWE has changed since the release of that document.

+ References
"Top 10 2007". OWASP. 2007-05-18. <http://www.owasp.org/index.php/Top_10_2007>.
+ Content History
Modifications
Modification DateModifierOrganizationSource
2008-09-08CWE Content TeamMITREInternal
updated Description, Name, Relationships, References, Relationship_Notes, View_Audience, View_Structure
2017-01-19CWE Content TeamMITREInternal
updated Relationships
Previous Entry Names
Change DatePrevious Entry Name
2008-09-09Weaknesses in OWASP Top Ten
+ View Metrics
CWEs in this viewTotal CWEs
Total38out of1005
Views0out of33
Categories10out of244
Weaknesses27out of720
Compound_Elements1out of8

More information is available — Please select a different filter.
Page Last Updated: January 18, 2017