CWE VIEW: Weaknesses in OWASP Top Ten (2017)
 Objective Audience
RelationshipsThe following graph shows the tree-like relationships between
weaknesses that exist at different levels of abstraction. At the highest level, categories
and pillars exist to group weaknesses. Categories (which are not technically weaknesses) are
special CWE entries used to group weaknesses that share a common characteristic. Pillars are
weaknesses that are described in the most abstract fashion. Below these top-level entries
are weaknesses are varying levels of abstraction. Classes are still very abstract, typically
independent of any specific language or technology. Base level weaknesses are used to
present a more specific type of weakness. A variant is a weakness that is described at a
very low level of detail, typically limited to a specific language or technology. A chain is
a set of weaknesses that must be reachable consecutively in order to produce an exploitable
vulnerability. While a composite is a set of weaknesses that must all be present
simultaneously in order to produce an exploitable vulnerability.
Show Details:
1026 - Weaknesses in OWASP Top Ten (2017)
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A1 - Injection
- (1027)
Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2017.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Improper Neutralization of Special Elements used in a Command
- (77)
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Command injection
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Neutralization of Special Elements used in an OS Command
- (78)
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Shell injection
Shell metacharacters
OS Command Injection
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Neutralization of Argument Delimiters in a Command
- (88)
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Argument Injection
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Neutralization of Special Elements used in an SQL Command
- (89)
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
SQL Injection
SQLi
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Neutralization of Special Elements used in an LDAP Query
- (90)
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
LDAP Injection
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
XML Injection
- (91)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Blind XPath Injection
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.
Use of Hibernate with HQL/SQL Query String Containing External Input
- (564)
The product uses Hibernate to execute a dynamic HQL or SQL statement, but the statement is built with user-controlled input.
HQL Injection
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Neutralization of Special Elements used in an Expression Language Statement
- (917)
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
EL Injection
Expression Language Injection
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Improper Neutralization of Special Elements in Data Query Logic
- (943)
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
NoSQL Injection, NoSQLi
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A2 - Broken Authentication
- (1028)
Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2017.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Improper Authentication
- (287)
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
authentification
AuthN
AuthC
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Plaintext Storage of a Password
- (256)
The product stores a password in plaintext within resources such as memory or files.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Use of Single-factor Authentication
- (308)
The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability.
Session Fixation
- (384)
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Insufficiently Protected Credentials
- (522)
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Unprotected Transport of Credentials
- (523)
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
Deprecated
DEPRECATED: Insufficient Session Expiration
- (613)
This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Unverified Password Change
- (620)
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Weak Password Recovery Mechanism for Forgotten Password
- (640)
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure
- (1029)
Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2017.
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.
Storage of File With Sensitive Data Under FTP Root
- (220)
The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Certificate Validation
- (295)
The product does not validate, or incorrectly validates, a certificate.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Missing Encryption of Sensitive Data
- (311)
The product does not encrypt sensitive or critical information before storage or transmission.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Cleartext Storage of Sensitive Information
- (312)
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Cleartext Transmission of Sensitive Information
- (319)
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
Key Management Errors
- (320)
Weaknesses in this category are related to errors in the management of cryptographic keys.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Missing Cryptographic Step
- (325)
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Inadequate Encryption Strength
- (326)
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Use of a Broken or Risky Cryptographic Algorithm
- (327)
The product uses a broken or risky cryptographic algorithm or protocol.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Use of Weak Hash
- (328)
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Exposure of Private Personal Information to an Unauthorized Actor
- (359)
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Privacy violation
Privacy leak / Privacy leakage
PPI
PII
PHI
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)
- (1030)
Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2017.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Restriction of XML External Entity Reference
- (611)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
XXE
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Restriction of Recursive Entity References in DTDs
- (776)
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
XEE
Billion Laughs Attack
XML Bomb
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A5 - Broken Access Control
- (1031)
Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2017.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Limitation of a Pathname to a Restricted Directory
- (22)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Path traversal
Directory traversal
Path transversal
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.
Improper Access Control
- (284)
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Authorization
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Improper Authorization
- (285)
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
AuthZ
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Direct Request
- (425)
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Forced Browsing
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Authorization Bypass Through User-Controlled Key
- (639)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Insecure Direct Object Reference / IDOR
Broken Object Level Authorization / BOLA
Horizontal Authorization
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A6 - Security Misconfiguration
- (1032)
Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2017.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
Configuration
- (16)
Weaknesses in this category are typically introduced during the configuration of the software.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Generation of Error Message Containing Sensitive Information
- (209)
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.
Exposure of Information Through Directory Listing
- (548)
The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS)
- (1033)
Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2017.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Neutralization of Input During Web Page Generation
- (79)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Cross-site Scripting
XSS
HTML Injection
Reflected XSS / Non-Persistent XSS / Type 1 XSS
Stored XSS / Persistent XSS / Type 2 XSS
DOM-Based XSS / Type 0 XSS
CSS
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A8 - Insecure Deserialization
- (1034)
Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2017.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Deserialization of Untrusted Data
- (502)
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Marshaling/Marshalling, Unmarshaling/Unmarshalling
Pickling, Unpickling
PHP Object Injection
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
- (1035)
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring
- (1036)
Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2017.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Omission of Security-relevant Information
- (223)
The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Insufficient Logging
- (778)
When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
Vulnerability Mapping Notes Notes References View Metrics
Content
History
|
||||||||||||||||||||||||||||||||||||||
