CWE

Common Weakness Enumeration

A Community-Developed List of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (2.11)  
ID

CWE VIEW: Weaknesses in OWASP Top Ten (2010)

View ID: 809
Structure: Graph
Status: Incomplete
Presentation Filter:
+ View Data

View Objective

CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2010.

+ View Audience
StakeholderDescription
Developers

This view outlines the most important issues as identified by the OWASP Top Ten (2010 version), providing a good starting point for web application developers who want to code more securely.

Software_Customers

This view outlines the most important issues as identified by the OWASP Top Ten (2010 version), providing customers with a way of asking their software developers to follow minimum expectations for secure code.

Educators

Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

+ Relationships
Show Details:
809 - Weaknesses in OWASP Top Ten (2010)
+CategoryCategoryOWASP Top Ten 2010 Category A1 - Injection - (810)
809 (Weaknesses in OWASP Top Ten (2010)) > 810 (OWASP Top Ten 2010 Category A1 - Injection)
Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2010.
*Weakness BaseWeakness BaseArgument Injection or Modification - (88)
809 (Weaknesses in OWASP Top Ten (2010)) > 810 (OWASP Top Ten 2010 Category A1 - Injection) > 88 (Argument Injection or Modification)
The software does not sufficiently delimit the arguments being passed to a component in another control sphere, allowing alternate arguments to be provided, leading to potentially security-relevant changes.
*Weakness BaseWeakness BaseImproper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') - (90)
809 (Weaknesses in OWASP Top Ten (2010)) > 810 (OWASP Top Ten 2010 Category A1 - Injection) > 90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))
The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
*Weakness BaseWeakness BaseImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - (78)
809 (Weaknesses in OWASP Top Ten (2010)) > 810 (OWASP Top Ten 2010 Category A1 - Injection) > 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Shell injectionShell metacharacters
*Weakness BaseWeakness BaseImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - (89)
809 (Weaknesses in OWASP Top Ten (2010)) > 810 (OWASP Top Ten 2010 Category A1 - Injection) > 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
*Weakness BaseWeakness BaseXML Injection (aka Blind XPath Injection) - (91)
809 (Weaknesses in OWASP Top Ten (2010)) > 810 (OWASP Top Ten 2010 Category A1 - Injection) > 91 (XML Injection (aka Blind XPath Injection))
The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
+CategoryCategoryOWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards - (819)
809 (Weaknesses in OWASP Top Ten (2010)) > 819 (OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards)
Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2010.
*Weakness VariantWeakness VariantURL Redirection to Untrusted Site ('Open Redirect') - (601)
809 (Weaknesses in OWASP Top Ten (2010)) > 819 (OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards) > 601 (URL Redirection to Untrusted Site ('Open Redirect'))
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.Open RedirectCross-site RedirectCross-domain Redirect
+CategoryCategoryOWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS) - (811)
809 (Weaknesses in OWASP Top Ten (2010)) > 811 (OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS))
Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2010.
*Weakness BaseWeakness BaseImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - (79)
809 (Weaknesses in OWASP Top Ten (2010)) > 811 (OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)) > 79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.XSSCSS
+CategoryCategoryOWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management - (812)
809 (Weaknesses in OWASP Top Ten (2010)) > 812 (OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management)
Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2010.
*Weakness ClassWeakness ClassImproper Authentication - (287)
809 (Weaknesses in OWASP Top Ten (2010)) > 812 (OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management) > 287 (Improper Authentication)
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.authentificationAuthC
*Weakness BaseWeakness BaseImproper Restriction of Excessive Authentication Attempts - (307)
809 (Weaknesses in OWASP Top Ten (2010)) > 812 (OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management) > 307 (Improper Restriction of Excessive Authentication Attempts)
The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
*Weakness VariantWeakness VariantMissing Authentication for Critical Function - (306)
809 (Weaknesses in OWASP Top Ten (2010)) > 812 (OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management) > 306 (Missing Authentication for Critical Function)
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
*Weakness BaseWeakness BaseUse of Hard-coded Credentials - (798)
809 (Weaknesses in OWASP Top Ten (2010)) > 812 (OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management) > 798 (Use of Hard-coded Credentials)
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
+CategoryCategoryOWASP Top Ten 2010 Category A4 - Insecure Direct Object References - (813)
809 (Weaknesses in OWASP Top Ten (2010)) > 813 (OWASP Top Ten 2010 Category A4 - Insecure Direct Object References)
Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2010.
*Weakness BaseWeakness BaseAuthorization Bypass Through User-Controlled Key - (639)
809 (Weaknesses in OWASP Top Ten (2010)) > 813 (OWASP Top Ten 2010 Category A4 - Insecure Direct Object References) > 639 (Authorization Bypass Through User-Controlled Key)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.Insecure Direct Object ReferenceHorizontal Authorization
*Weakness BaseWeakness BaseImproper Control of Resource Identifiers ('Resource Injection') - (99)
809 (Weaknesses in OWASP Top Ten (2010)) > 813 (OWASP Top Ten 2010 Category A4 - Insecure Direct Object References) > 99 (Improper Control of Resource Identifiers ('Resource Injection'))
The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.Insecure Direct Object Reference
*Weakness ClassWeakness ClassImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - (22)
809 (Weaknesses in OWASP Top Ten (2010)) > 813 (OWASP Top Ten 2010 Category A4 - Insecure Direct Object References) > 22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Directory traversalPath traversal
*Weakness ClassWeakness ClassInclusion of Functionality from Untrusted Control Sphere - (829)
809 (Weaknesses in OWASP Top Ten (2010)) > 813 (OWASP Top Ten 2010 Category A4 - Insecure Direct Object References) > 829 (Inclusion of Functionality from Untrusted Control Sphere)
The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
*Weakness ClassWeakness ClassIncorrect Authorization - (863)
809 (Weaknesses in OWASP Top Ten (2010)) > 813 (OWASP Top Ten 2010 Category A4 - Insecure Direct Object References) > 863 (Incorrect Authorization)
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.AuthZ
*Weakness ClassWeakness ClassMissing Authorization - (862)
809 (Weaknesses in OWASP Top Ten (2010)) > 813 (OWASP Top Ten 2010 Category A4 - Insecure Direct Object References) > 862 (Missing Authorization)
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.AuthZ
*Weakness BaseWeakness BaseUnrestricted Upload of File with Dangerous Type - (434)
809 (Weaknesses in OWASP Top Ten (2010)) > 813 (OWASP Top Ten 2010 Category A4 - Insecure Direct Object References) > 434 (Unrestricted Upload of File with Dangerous Type)
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.Unrestricted File Upload
+CategoryCategoryOWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF) - (814)
809 (Weaknesses in OWASP Top Ten (2010)) > 814 (OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF))
Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2010.
+Compound Element: CompositeCompound Element: CompositeCross-Site Request Forgery (CSRF) - (352)
809 (Weaknesses in OWASP Top Ten (2010)) > 814 (OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)) > 352 (Cross-Site Request Forgery (CSRF))
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Session RidingCross Site Reference ForgeryXSRF
*Weakness ClassWeakness ClassExternal Control of Critical State Data - (642)
809 (Weaknesses in OWASP Top Ten (2010)) > 814 (OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)) > 352 (Cross-Site Request Forgery (CSRF)) > 642 (External Control of Critical State Data)
The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.
*Weakness BaseWeakness BaseInsufficient Session Expiration - (613)
809 (Weaknesses in OWASP Top Ten (2010)) > 814 (OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)) > 352 (Cross-Site Request Forgery (CSRF)) > 613 (Insufficient Session Expiration)
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
*Weakness BaseWeakness BaseOrigin Validation Error - (346)
809 (Weaknesses in OWASP Top Ten (2010)) > 814 (OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)) > 352 (Cross-Site Request Forgery (CSRF)) > 346 (Origin Validation Error)
The software does not properly verify that the source of data or communication is valid.
*Weakness ClassWeakness ClassUnintended Proxy or Intermediary ('Confused Deputy') - (441)
809 (Weaknesses in OWASP Top Ten (2010)) > 814 (OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)) > 352 (Cross-Site Request Forgery (CSRF)) > 441 (Unintended Proxy or Intermediary ('Confused Deputy'))
The software receives a request, message, or directive from an upstream component, but the software does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the software's control sphere. This causes the software to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.Confused Deputy
+CategoryCategoryOWASP Top Ten 2010 Category A6 - Security Misconfiguration - (815)
809 (Weaknesses in OWASP Top Ten (2010)) > 815 (OWASP Top Ten 2010 Category A6 - Security Misconfiguration)
Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2010.
*Weakness ClassWeakness ClassExecution with Unnecessary Privileges - (250)
809 (Weaknesses in OWASP Top Ten (2010)) > 815 (OWASP Top Ten 2010 Category A6 - Security Misconfiguration) > 250 (Execution with Unnecessary Privileges)
The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
*Weakness BaseWeakness BaseFile and Directory Information Exposure - (538)
809 (Weaknesses in OWASP Top Ten (2010)) > 815 (OWASP Top Ten 2010 Category A6 - Security Misconfiguration) > 538 (File and Directory Information Exposure)
The product stores sensitive information in files or directories that are accessible to actors outside of the intended control sphere.
*Weakness BaseWeakness BaseFiles or Directories Accessible to External Parties - (552)
809 (Weaknesses in OWASP Top Ten (2010)) > 815 (OWASP Top Ten 2010 Category A6 - Security Misconfiguration) > 552 (Files or Directories Accessible to External Parties)
Files or directories are accessible in the environment that should not be.
*Weakness ClassWeakness ClassIncorrect Permission Assignment for Critical Resource - (732)
809 (Weaknesses in OWASP Top Ten (2010)) > 815 (OWASP Top Ten 2010 Category A6 - Security Misconfiguration) > 732 (Incorrect Permission Assignment for Critical Resource)
The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
*Weakness BaseWeakness BaseInformation Exposure Through an Error Message - (209)
809 (Weaknesses in OWASP Top Ten (2010)) > 815 (OWASP Top Ten 2010 Category A6 - Security Misconfiguration) > 209 (Information Exposure Through an Error Message)
The software generates an error message that includes sensitive information about its environment, users, or associated data.
*Weakness VariantWeakness VariantSensitive Data Under Web Root - (219)
809 (Weaknesses in OWASP Top Ten (2010)) > 815 (OWASP Top Ten 2010 Category A6 - Security Misconfiguration) > 219 (Sensitive Data Under Web Root)
The application stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
+CategoryCategoryOWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage - (816)
809 (Weaknesses in OWASP Top Ten (2010)) > 816 (OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage)
Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2010.
*Weakness BaseWeakness BaseCleartext Storage of Sensitive Information - (312)
809 (Weaknesses in OWASP Top Ten (2010)) > 816 (OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage) > 312 (Cleartext Storage of Sensitive Information)
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
*Weakness ClassWeakness ClassInadequate Encryption Strength - (326)
809 (Weaknesses in OWASP Top Ten (2010)) > 816 (OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage) > 326 (Inadequate Encryption Strength)
The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
*Weakness BaseWeakness BaseMissing Encryption of Sensitive Data - (311)
809 (Weaknesses in OWASP Top Ten (2010)) > 816 (OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage) > 311 (Missing Encryption of Sensitive Data)
The software does not encrypt sensitive or critical information before storage or transmission.
*Weakness BaseWeakness BaseUse of a Broken or Risky Cryptographic Algorithm - (327)
809 (Weaknesses in OWASP Top Ten (2010)) > 816 (OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage) > 327 (Use of a Broken or Risky Cryptographic Algorithm)
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
*Weakness BaseWeakness BaseUse of a One-Way Hash without a Salt - (759)
809 (Weaknesses in OWASP Top Ten (2010)) > 816 (OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage) > 759 (Use of a One-Way Hash without a Salt)
The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input.
+CategoryCategoryOWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access - (817)
809 (Weaknesses in OWASP Top Ten (2010)) > 817 (OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access)
Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2010.
*Weakness ClassWeakness ClassImproper Authorization - (285)
809 (Weaknesses in OWASP Top Ten (2010)) > 817 (OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access) > 285 (Improper Authorization)
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.AuthZ
*Weakness ClassWeakness ClassIncorrect Authorization - (863)
809 (Weaknesses in OWASP Top Ten (2010)) > 817 (OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access) > 863 (Incorrect Authorization)
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.AuthZ
*Weakness ClassWeakness ClassMissing Authorization - (862)
809 (Weaknesses in OWASP Top Ten (2010)) > 817 (OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access) > 862 (Missing Authorization)
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.AuthZ
+CategoryCategoryOWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection - (818)
809 (Weaknesses in OWASP Top Ten (2010)) > 818 (OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection)
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2010.
*Weakness BaseWeakness BaseCleartext Transmission of Sensitive Information - (319)
809 (Weaknesses in OWASP Top Ten (2010)) > 818 (OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection) > 319 (Cleartext Transmission of Sensitive Information)
The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
*Weakness BaseWeakness BaseMissing Encryption of Sensitive Data - (311)
809 (Weaknesses in OWASP Top Ten (2010)) > 818 (OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection) > 311 (Missing Encryption of Sensitive Data)
The software does not encrypt sensitive or critical information before storage or transmission.
+ Relationship Notes

The relationships in this view are a direct extraction of the CWE mappings that are in the 2010 OWASP document. CWE has changed since the release of that document.

+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2010-06-17MITREInternal CWE Team
Modifications
Modification DateModifierOrganizationSource
2013-07-16MITREInternal
Updated Reference URL
2013-07-17CWE Content TeamMITREInternal
updated References
+ View Metrics
CWEs in this viewTotal CWEs
Total42out of1006
Views0out of33
Categories10out of245
Weaknesses31out of720
Compound_Elements1out of8

More information is available — Please select a different filter.
Page Last Updated: May 05, 2017