Common Weakness Enumeration

CWE Glossary Definition

Discussion of Issues in CWE Draft 6
Discussion of Issues in CWE Draft 6

Following is a summary of the main overall issues in CWE Draft 6.

• Some "weakness" nodes are not about weaknesses. The most noticeable are nodes that are focused on attacks (e.g. HTTP Response Splitting, Man-in-the-Middle). CWE also has grouping nodes such as "Authentication Issues" that might be useful for navigation but are not weaknesses themselves.
• Abstraction Challenges. Some nodes might be broken down into sub-nodes in ways that don't make sense to some users. Others might be regarded as too high-level. Some nodes might be too low-level.
• Different Perspectives. CWE nodes can be organized and described along different perspectives, which might not be suitable for some users.
• Usability. There are different types of users of CWE, but its current layout and navigation is relatively limited.
• Incomplete Entries. There are numerous fields available for CWE nodes, but many entries do not have as much detailed information as they could, including the description and relationships.
• Vague Names or Descriptions. Some entries have names or descriptions that do not clearly describe the issue.

Document version: 0.1    Date: September 13, 2007

This is a draft document. It is intended to support maintenance of CWE, and to educate and solicit feedback from a specific technical audience. This document does not reflect any official position of the MITRE Corporation or its sponsors. Copyright © 2007, The MITRE Corporation. All rights reserved. Permission is granted to redistribute this document if this paragraph is not removed. This document is subject to change without notice.