CWE

Common Weakness Enumeration

A Community-Developed List of Software & Hardware Weakness Types

2021 CWE Most Important Hardware Weaknesses
CWE Top 25 Most Dangerous Weaknesses
Home > CWE List > CWE- Individual Dictionary Definition (4.6)  
ID

CWE VIEW: Weaknesses in OWASP Top Ten (2021)

View ID: 1344
Type: Graph
Status: Incomplete
Downloads: Booklet | CSV | XML
+ Objective
CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021.
+ Audience
StakeholderDescription
Software DevelopersThis view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing a good starting point for web application developers who want to code more securely.
Product CustomersThis view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
EducatorsSince the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.
+ Relationships
The following graph shows the tree-like relationships between weaknesses that exist at different levels of abstraction. At the highest level, categories and pillars exist to group weaknesses. Categories (which are not technically weaknesses) are special CWE entries used to group weaknesses that share a common characteristic. Pillars are weaknesses that are described in the most abstract fashion. Below these top-level entries are weaknesses are varying levels of abstraction. Classes are still very abstract, typically independent of any specific language or technology. Base level weaknesses are used to present a more specific type of weakness. A variant is a weakness that is described at a very low level of detail, typically limited to a specific language or technology. A chain is a set of weaknesses that must be reachable consecutively in order to produce an exploitable vulnerability. While a composite is a set of weaknesses that must all be present simultaneously in order to produce an exploitable vulnerability.
Show Details:
1344 - Weaknesses in OWASP Top Ten (2021)
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A01:2021 - Broken Access Control - (1345)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control)
Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - (22)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Directory traversalPath traversal
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Relative Path Traversal - (23)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 23 (Relative Path Traversal)
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Path Traversal: '.../...//' - (35)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 35 (Path Traversal: '.../...//')
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Link Resolution Before File Access ('Link Following') - (59)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 59 (Improper Link Resolution Before File Access ('Link Following'))
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.insecure temporary file
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Exposure of Sensitive Information to an Unauthorized Actor - (200)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 200 (Exposure of Sensitive Information to an Unauthorized Actor)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Information DisclosureInformation Leak
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Insertion of Sensitive Information Into Sent Data - (201)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 201 (Insertion of Sensitive Information Into Sent Data)
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Storage of File with Sensitive Data Under Web Root - (219)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 219 (Storage of File with Sensitive Data Under Web Root)
The application stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.Permissions, Privileges, and Access Controls - (264)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 264 (Permissions, Privileges, and Access Controls)
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.Permission Issues - (275)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 275 (Permission Issues)
Weaknesses in this category are related to improper assignment or handling of permissions.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Incorrect Default Permissions - (276)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 276 (Incorrect Default Permissions)
During installation, installed file permissions are set to allow anyone to modify those files.
*PillarPillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.Improper Access Control - (284)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 284 (Improper Access Control)
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Authorization
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Authorization - (285)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 285 (Improper Authorization)
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.AuthZ
*CompositeComposite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability.Cross-Site Request Forgery (CSRF) - (352)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 352 (Cross-Site Request Forgery (CSRF))
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Session RidingCross Site Reference ForgeryXSRF
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Exposure of Private Personal Information to an Unauthorized Actor - (359)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 359 (Exposure of Private Personal Information to an Unauthorized Actor)
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.Privacy violationPrivacy leakPrivacy leakage
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Insecure Temporary File - (377)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 377 (Insecure Temporary File)
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Transmission of Private Resources into a New Sphere ('Resource Leak') - (402)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
The software makes resources available to untrusted parties when those resources are only intended to be accessed by the software.Resource Leak
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Direct Request ('Forced Browsing') - (425)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 425 (Direct Request ('Forced Browsing'))
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.forced browsing
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Unintended Proxy or Intermediary ('Confused Deputy') - (441)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 441 (Unintended Proxy or Intermediary ('Confused Deputy'))
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.Confused Deputy
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Exposure of Sensitive System Information to an Unauthorized Control Sphere - (497)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere)
The application does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the application does.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Insertion of Sensitive Information into Externally-Accessible File or Directory - (538)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 538 (Insertion of Sensitive Information into Externally-Accessible File or Directory)
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Inclusion of Sensitive Information in Source Code - (540)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 540 (Inclusion of Sensitive Information in Source Code)
Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Exposure of Information Through Directory Listing - (548)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 548 (Exposure of Information Through Directory Listing)
A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Files or Directories Accessible to External Parties - (552)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 552 (Files or Directories Accessible to External Parties)
The product makes files or directories accessible to unauthorized actors, even though they should not be.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Authorization Bypass Through User-Controlled SQL Primary Key - (566)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 566 (Authorization Bypass Through User-Controlled SQL Primary Key)
The software uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.URL Redirection to Untrusted Site ('Open Redirect') - (601)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 601 (URL Redirection to Untrusted Site ('Open Redirect'))
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.Open RedirectCross-site RedirectCross-domain Redirect
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Authorization Bypass Through User-Controlled Key - (639)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 639 (Authorization Bypass Through User-Controlled Key)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.Insecure Direct Object Reference / IDORBroken Object Level Authorization / BOLAHorizontal Authorization
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Exposure of WSDL File Containing Sensitive Information - (651)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 651 (Exposure of WSDL File Containing Sensitive Information)
The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Exposure of Resource to Wrong Sphere - (668)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 668 (Exposure of Resource to Wrong Sphere)
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Use of Incorrectly-Resolved Name or Reference - (706)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 706 (Use of Incorrectly-Resolved Name or Reference)
The software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Missing Authorization - (862)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 862 (Missing Authorization)
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.AuthZ
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Incorrect Authorization - (863)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 863 (Incorrect Authorization)
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.AuthZ
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Control of Dynamically-Managed Code Resources - (913)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 913 (Improper Control of Dynamically-Managed Code Resources)
The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Insecure Storage of Sensitive Information - (922)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 922 (Insecure Storage of Sensitive Information)
The software stores sensitive information without properly limiting read or write access by unauthorized actors.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Sensitive Cookie with Improper SameSite Attribute - (1275)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1345 (OWASP Top Ten 2021 Category A01:2021 - Broken Access Control) > 1275 (Sensitive Cookie with Improper SameSite Attribute)
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures - (1346)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures)
Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top Ten 2021.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Weak Encoding for Password - (261)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 261 (Weak Encoding for Password)
Obscuring a password with a trivial encoding does not protect the password.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Following of a Certificate's Chain of Trust - (296)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 296 (Improper Following of a Certificate's Chain of Trust)
The software does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.Cryptographic Issues - (310)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 310 (Cryptographic Issues)
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Cleartext Transmission of Sensitive Information - (319)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 319 (Cleartext Transmission of Sensitive Information)
The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of Hard-coded Cryptographic Key - (321)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 321 (Use of Hard-coded Cryptographic Key)
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Key Exchange without Entity Authentication - (322)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 322 (Key Exchange without Entity Authentication)
The software performs a key exchange with an actor without verifying the identity of that actor.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Reusing a Nonce, Key Pair in Encryption - (323)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 323 (Reusing a Nonce, Key Pair in Encryption)
Nonces should be used for the present occasion and only once.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Use of a Key Past its Expiration Date - (324)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 324 (Use of a Key Past its Expiration Date)
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Missing Cryptographic Step - (325)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 325 (Missing Cryptographic Step)
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Inadequate Encryption Strength - (326)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 326 (Inadequate Encryption Strength)
The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Use of a Broken or Risky Cryptographic Algorithm - (327)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 327 (Use of a Broken or Risky Cryptographic Algorithm)
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Use of Weak Hash - (328)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 328 (Use of Weak Hash)
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Generation of Predictable IV with CBC Mode - (329)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 329 (Generation of Predictable IV with CBC Mode)
The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Use of Insufficiently Random Values - (330)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 330 (Use of Insufficiently Random Values)
The software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Insufficient Entropy - (331)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 331 (Insufficient Entropy)
The software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) - (335)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 335 (Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG))
The software uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Same Seed in Pseudo-Random Number Generator (PRNG) - (336)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 336 (Same Seed in Pseudo-Random Number Generator (PRNG))
A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Predictable Seed in Pseudo-Random Number Generator (PRNG) - (337)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 337 (Predictable Seed in Pseudo-Random Number Generator (PRNG))
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - (338)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 338 (Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG))
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Generation of Predictable Numbers or Identifiers - (340)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 340 (Generation of Predictable Numbers or Identifiers)
The product uses a scheme that generates numbers or identifiers that are more predictable than required.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Verification of Cryptographic Signature - (347)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 347 (Improper Verification of Cryptographic Signature)
The software does not verify, or incorrectly verifies, the cryptographic signature for data.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Unprotected Transport of Credentials - (523)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 523 (Unprotected Transport of Credentials)
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2007 Category A9 - Insecure Communications - (720)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 720 (OWASP Top Ten 2007 Category A9 - Insecure Communications)
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2007.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') - (757)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 757 (Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'))
A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of a One-Way Hash without a Salt - (759)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 759 (Use of a One-Way Hash without a Salt)
The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of a One-Way Hash with a Predictable Salt - (760)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 760 (Use of a One-Way Hash with a Predictable Salt)
The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software uses a predictable salt as part of the input.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of RSA Algorithm without OAEP - (780)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 780 (Use of RSA Algorithm without OAEP)
The software uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection - (818)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 818 (OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection)
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2010.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Use of Password Hash With Insufficient Computational Effort - (916)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1346 (OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures) > 916 (Use of Password Hash With Insufficient Computational Effort)
The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A03:2021 - Injection - (1347)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection)
Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top Ten 2021.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Input Validation - (20)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 20 (Improper Input Validation)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - (74)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) - (75)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 75 (Failure to Sanitize Special Elements into a Different Plane (Special Element Injection))
The software does not adequately filter user-controlled input for special elements with control implications.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Neutralization of Special Elements used in a Command ('Command Injection') - (77)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - (78)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Shell injectionShell metacharacters
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - (79)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.XSSHTML InjectionCSS
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - (80)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Script in Attributes in a Web Page - (83)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 83 (Improper Neutralization of Script in Attributes in a Web Page)
The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Alternate XSS Syntax - (87)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 87 (Improper Neutralization of Alternate XSS Syntax)
The software does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') - (88)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - (89)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') - (90)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))
The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.XML Injection (aka Blind XPath Injection) - (91)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 91 (XML Injection (aka Blind XPath Injection))
The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of CRLF Sequences ('CRLF Injection') - (93)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Control of Generation of Code ('Code Injection') - (94)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 94 (Improper Control of Generation of Code ('Code Injection'))
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') - (95)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'))
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') - (96)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 96 (Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection'))
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Server-Side Includes (SSI) Within a Web Page - (97)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 97 (Improper Neutralization of Server-Side Includes (SSI) Within a Web Page)
The software generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') - (98)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'))
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.Remote file includeRFILocal file inclusion
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Control of Resource Identifiers ('Resource Injection') - (99)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 99 (Improper Control of Resource Identifiers ('Resource Injection'))
The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.Insecure Direct Object Reference
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') - (113)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting'))
The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Encoding or Escaping of Output - (116)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 116 (Improper Encoding or Escaping of Output)
The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.Output SanitizationOutput ValidationOutput Encoding
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Neutralization of Special Elements - (138)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 138 (Improper Neutralization of Special Elements)
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Incomplete List of Disallowed Inputs - (184)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 184 (Incomplete List of Disallowed Inputs)
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.Denylist / Deny ListBlocklist / Block ListBlacklist / Black List
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') - (470)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'))
The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.Reflection Injection
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Modification of Assumed-Immutable Data (MAID) - (471)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 471 (Modification of Assumed-Immutable Data (MAID))
The software does not properly protect an assumed-immutable element from being modified by an attacker.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.SQL Injection: Hibernate - (564)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 564 (SQL Injection: Hibernate)
Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Externally Controlled Reference to a Resource in Another Sphere - (610)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 610 (Externally Controlled Reference to a Resource in Another Sphere)
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Data within XPath Expressions ('XPath Injection') - (643)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 643 (Improper Neutralization of Data within XPath Expressions ('XPath Injection'))
The software uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of HTTP Headers for Scripting Syntax - (644)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 644 (Improper Neutralization of HTTP Headers for Scripting Syntax)
The application does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') - (652)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 652 (Improper Neutralization of Data within XQuery Expressions ('XQuery Injection'))
The software uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') - (917)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1347 (OWASP Top Ten 2021 Category A03:2021 - Injection) > 917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'))
The software constructs all or part of an expression language (EL) statement in a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.EL Injection
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A04:2021 - Insecure Design - (1348)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design)
Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top Ten 2021.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.External Control of File Name or Path - (73)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 73 (External Control of File Name or Path)
The software allows user input to control or influence paths or file names that are used in filesystem operations.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Permissive List of Allowed Inputs - (183)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 183 (Permissive List of Allowed Inputs)
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.Allowlist / Allow ListSafelist / Safe ListWhitelist / White List
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Generation of Error Message Containing Sensitive Information - (209)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 209 (Generation of Error Message Containing Sensitive Information)
The software generates an error message that includes sensitive information about its environment, users, or associated data.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Exposure of Sensitive Information Due to Incompatible Policies - (213)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 213 (Exposure of Sensitive Information Due to Incompatible Policies)
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Handling of Extra Parameters - (235)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 235 (Improper Handling of Extra Parameters)
The software does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Plaintext Storage of a Password - (256)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 256 (Plaintext Storage of a Password)
Storing a password in plaintext may result in a system compromise.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Storing Passwords in a Recoverable Format - (257)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 257 (Storing Passwords in a Recoverable Format)
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Incorrect Privilege Assignment - (266)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 266 (Incorrect Privilege Assignment)
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Privilege Management - (269)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 269 (Improper Privilege Management)
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Handling of Insufficient Permissions or Privileges - (280)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 280 (Improper Handling of Insufficient Permissions or Privileges )
The application does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the application in an invalid state.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Missing Encryption of Sensitive Data - (311)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 311 (Missing Encryption of Sensitive Data)
The software does not encrypt sensitive or critical information before storage or transmission.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Cleartext Storage of Sensitive Information - (312)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 312 (Cleartext Storage of Sensitive Information)
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Cleartext Storage in a File or on Disk - (313)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 313 (Cleartext Storage in a File or on Disk)
The application stores sensitive information in cleartext in a file, or on disk.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Cleartext Storage of Sensitive Information in Memory - (316)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 316 (Cleartext Storage of Sensitive Information in Memory)
The application stores sensitive information in cleartext in memory.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Unprotected Primary Channel - (419)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 419 (Unprotected Primary Channel)
The software uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Deployment of Wrong Handler - (430)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 430 (Deployment of Wrong Handler)
The wrong "handler" is assigned to process an object.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Unrestricted Upload of File with Dangerous Type - (434)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 434 (Unrestricted Upload of File with Dangerous Type)
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.Unrestricted File Upload
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') - (444)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling'))
When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being aware of it.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.User Interface (UI) Misrepresentation of Critical Information - (451)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 451 (User Interface (UI) Misrepresentation of Critical Information)
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.External Control of Assumed-Immutable Web Parameter - (472)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 472 (External Control of Assumed-Immutable Web Parameter)
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.Assumed-Immutable Parameter Tampering
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Trust Boundary Violation - (501)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 501 (Trust Boundary Violation)
The product mixes trusted and untrusted data in the same data structure or structured message.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Insufficiently Protected Credentials - (522)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 522 (Insufficiently Protected Credentials)
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of Web Browser Cache Containing Sensitive Information - (525)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 525 (Use of Web Browser Cache Containing Sensitive Information)
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of Persistent Cookies Containing Sensitive Information - (539)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 539 (Use of Persistent Cookies Containing Sensitive Information)
The web application uses persistent cookies, but the cookies contain sensitive information.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.J2EE Bad Practices: Non-serializable Object Stored in Session - (579)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 579 (J2EE Bad Practices: Non-serializable Object Stored in Session)
The application stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of GET Request Method With Sensitive Query Strings - (598)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 598 (Use of GET Request Method With Sensitive Query Strings)
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Client-Side Enforcement of Server-Side Security - (602)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 602 (Client-Side Enforcement of Server-Side Security)
The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.External Control of Critical State Data - (642)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 642 (External Control of Critical State Data)
The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Reliance on File Name or Extension of Externally-Supplied File - (646)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 646 (Reliance on File Name or Extension of Externally-Supplied File)
The software allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Trusting HTTP Permission Methods on the Server Side - (650)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 650 (Trusting HTTP Permission Methods on the Server Side)
The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Isolation or Compartmentalization - (653)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 653 (Improper Isolation or Compartmentalization)
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.Separation of Privilege
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Reliance on Security Through Obscurity - (656)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 656 (Reliance on Security Through Obscurity)
The software uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.Never Assuming your secrets are safe
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Violation of Secure Design Principles - (657)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 657 (Violation of Secure Design Principles)
The product violates well-established principles for secure design.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Control of Interaction Frequency - (799)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 799 (Improper Control of Interaction Frequency)
The software does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.Insufficient anti-automationBrute force
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Reliance on Untrusted Inputs in a Security Decision - (807)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 807 (Reliance on Untrusted Inputs in a Security Decision)
The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.Business Logic Errors - (840)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 840 (Business Logic Errors)
Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Enforcement of Behavioral Workflow - (841)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 841 (Improper Enforcement of Behavioral Workflow)
The software supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of Implicit Intent for Sensitive Communication - (927)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 927 (Use of Implicit Intent for Sensitive Communication)
The Android application uses an implicit intent for transmitting sensitive data to other applications.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Restriction of Rendered UI Layers or Frames - (1021)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 1021 (Improper Restriction of Rendered UI Layers or Frames)
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.ClickjackingUI Redress AttackTapjacking
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Use of Validation Framework - (1173)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1348 (OWASP Top Ten 2021 Category A04:2021 - Insecure Design) > 1173 (Improper Use of Validation Framework)
The application does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration - (1349)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration)
Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top Ten 2021.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.7PK - Environment - (2)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 2 (7PK - Environment)
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.ASP.NET Misconfiguration: Creating Debug Binary - (11)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 11 (ASP.NET Misconfiguration: Creating Debug Binary)
Debugging messages help attackers learn about the system and plan a form of attack.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.ASP.NET Misconfiguration: Password in Configuration File - (13)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 13 (ASP.NET Misconfiguration: Password in Configuration File)
Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.External Control of System or Configuration Setting - (15)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 15 (External Control of System or Configuration Setting)
One or more system settings or configuration elements can be externally controlled by a user.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.Configuration - (16)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 16 (Configuration)
Weaknesses in this category are typically introduced during the configuration of the software.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Password in Configuration File - (260)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 260 (Password in Configuration File)
The software stores a password in a configuration file that might be accessible to actors who do not know the password.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Cleartext Storage of Sensitive Information in a Cookie - (315)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 315 (Cleartext Storage of Sensitive Information in a Cookie)
The application stores sensitive information in cleartext in a cookie.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource..NET Misconfiguration: Use of Impersonation - (520)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 520 (.NET Misconfiguration: Use of Impersonation)
Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Exposure of Sensitive Information Through Environmental Variables - (526)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 526 (Exposure of Sensitive Information Through Environmental Variables)
Environmental variables may contain sensitive information about a remote server.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Java Runtime Error Message Containing Sensitive Information - (537)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 537 (Java Runtime Error Message Containing Sensitive Information)
In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Inclusion of Sensitive Information in an Include File - (541)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 541 (Inclusion of Sensitive Information in an Include File)
If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of Hard-coded, Security-relevant Constants - (547)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 547 (Use of Hard-coded, Security-relevant Constants)
The program uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Restriction of XML External Entity Reference - (611)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 611 (Improper Restriction of XML External Entity Reference)
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.XXE
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Sensitive Cookie in HTTPS Session Without 'Secure' Attribute - (614)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute)
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Missing Custom Error Page - (756)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 756 (Missing Custom Error Page)
The software does not return custom error pages to the user, possibly exposing sensitive information.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') - (776)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 776 (Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'))
The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.XEEBillion Laughs AttackXML Bomb
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Permissive Cross-domain Policy with Untrusted Domains - (942)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 942 (Permissive Cross-domain Policy with Untrusted Domains)
The software uses a cross-domain policy file that includes domains that should not be trusted.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Sensitive Cookie Without 'HttpOnly' Flag - (1004)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 1004 (Sensitive Cookie Without 'HttpOnly' Flag)
The software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2017 Category A6 - Security Misconfiguration - (1032)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 1032 (OWASP Top Ten 2017 Category A6 - Security Misconfiguration)
Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2017.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.ASP.NET Misconfiguration: Improper Model Validation - (1174)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1349 (OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration) > 1174 (ASP.NET Misconfiguration: Improper Model Validation)
The ASP.NET application does not use, or incorrectly uses, the model validation framework.
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components - (1352)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1352 (OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components)
Weaknesses in this category are related to the A06 category "Vulnerable and Outdated Components" in the OWASP Top Ten 2021.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities - (937)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1352 (OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components) > 937 (OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities)
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities - (1035)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1352 (OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components) > 1035 (OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities)
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Use of Unmaintained Third Party Components - (1104)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1352 (OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components) > 1104 (Use of Unmaintained Third Party Components)
The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures - (1353)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures)
Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top Ten 2021.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.Credentials Management Errors - (255)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 255 (Credentials Management Errors)
Weaknesses in this category are related to the management of credentials.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Use of Hard-coded Password - (259)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 259 (Use of Hard-coded Password)
The software contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Improper Authentication - (287)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 287 (Improper Authentication)
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.authentificationAuthNAuthC
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Authentication Bypass Using an Alternate Path or Channel - (288)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 288 (Authentication Bypass Using an Alternate Path or Channel)
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Authentication Bypass by Spoofing - (290)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 290 (Authentication Bypass by Spoofing)
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Authentication Bypass by Capture-replay - (294)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 294 (Authentication Bypass by Capture-replay)
A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Certificate Validation - (295)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 295 (Improper Certificate Validation)
The software does not validate, or incorrectly validates, a certificate.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Improper Validation of Certificate with Host Mismatch - (297)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 297 (Improper Validation of Certificate with Host Mismatch)
The software communicates with a host that provides a certificate, but the software does not properly ensure that the certificate is actually associated with that host.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Channel Accessible by Non-Endpoint - (300)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 300 (Channel Accessible by Non-Endpoint)
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.Adversary-in-the-Middle / AITMMan-in-the-Middle / MITMPerson-in-the-Middle / PITMMonkey-in-the-MiddleMonster-in-the-MiddleOn-path attackInterception attack
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Authentication Bypass by Assumed-Immutable Data - (302)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 302 (Authentication Bypass by Assumed-Immutable Data)
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Missing Critical Step in Authentication - (304)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 304 (Missing Critical Step in Authentication)
The software implements an authentication technique, but it skips a step that weakens the technique.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Missing Authentication for Critical Function - (306)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 306 (Missing Authentication for Critical Function)
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Restriction of Excessive Authentication Attempts - (307)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 307 (Improper Restriction of Excessive Authentication Attempts)
The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Origin Validation Error - (346)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 346 (Origin Validation Error)
The software does not properly verify that the source of data or communication is valid.
*CompositeComposite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability.Session Fixation - (384)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 384 (Session Fixation)
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Weak Password Requirements - (521)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 521 (Weak Password Requirements)
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Insufficient Session Expiration - (613)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 613 (Insufficient Session Expiration)
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Unverified Password Change - (620)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 620 (Unverified Password Change)
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Weak Password Recovery Mechanism for Forgotten Password - (640)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 640 (Weak Password Recovery Mechanism for Forgotten Password)
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Use of Hard-coded Credentials - (798)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 798 (Use of Hard-coded Credentials)
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Verification of Source of a Communication Channel - (940)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 940 (Improper Verification of Source of a Communication Channel)
The software establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
*CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.Lockout Mechanism Errors - (1216)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1353 (OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures) > 1216 (Lockout Mechanism Errors)
Weaknesses in this category are related to a software system's lockout mechanism. Frequently these deal with scenarios that take effect in case of multiple failed attempts to access a given resource. The weaknesses in this category could lead to a degradation of access to system assets if they are not addressed.
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures - (1354)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures)
Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top Ten 2021.
*ClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.Insufficient Verification of Data Authenticity - (345)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 345 (Insufficient Verification of Data Authenticity)
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Missing Support for Integrity Check - (353)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 353 (Missing Support for Integrity Check)
The software uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Untrusted Search Path - (426)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 426 (Untrusted Search Path)
The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.Untrusted Path
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Download of Code Without Integrity Check - (494)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 494 (Download of Code Without Integrity Check)
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Deserialization of Untrusted Data - (502)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 502 (Deserialization of Untrusted Data)
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.Marshaling, UnmarshalingPickling, UnpicklingPHP Object Injection
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Reliance on Cookies without Validation and Integrity Checking - (565)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 565 (Reliance on Cookies without Validation and Integrity Checking)
The application relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Reliance on Cookies without Validation and Integrity Checking in a Security Decision - (784)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 784 (Reliance on Cookies without Validation and Integrity Checking in a Security Decision)
The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Inclusion of Functionality from Untrusted Control Sphere - (829)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 829 (Inclusion of Functionality from Untrusted Control Sphere)
The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
*VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.Inclusion of Web Functionality from an Untrusted Source - (830)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 830 (Inclusion of Web Functionality from an Untrusted Source)
The software includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the software, potentially granting total access and control of the software to the untrusted source.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improperly Controlled Modification of Dynamically-Determined Object Attributes - (915)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1354 (OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures) > 915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)
The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.Mass AssignmentAutoBindingPHP Object Injection
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures - (1355)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures)
Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top Ten 2021.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Improper Output Neutralization for Logs - (117)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures) > 117 (Improper Output Neutralization for Logs)
The software does not neutralize or incorrectly neutralizes output that is written to logs.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Omission of Security-relevant Information - (223)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures) > 223 (Omission of Security-relevant Information)
The application does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Insertion of Sensitive Information into Log File - (532)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures) > 532 (Insertion of Sensitive Information into Log File)
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Insufficient Logging - (778)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1355 (OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures) > 778 (Insufficient Logging)
When a security-critical event occurs, the software either does not record the event or omits important details about the event when logging it.
+CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF) - (1356)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1356 (OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF))
Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top Ten 2021.
*BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.Server-Side Request Forgery (SSRF) - (918)
1344 (Weaknesses in OWASP Top Ten (2021)) > 1356 (OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF)) > 918 (Server-Side Request Forgery (SSRF))
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.XSPA
+ Notes

Maintenance

As of CWE 4.6, the relationships in this view were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.
+ References
[REF-1206] "OWASP Top 10:2021". OWASP. 2021-09-24. <https://owasp.org/Top10/>.
+ View Metrics
CWEs in this viewTotal CWEs
Weaknesses182out of 924
Categories23out of 326
Views0out of 46
Total205out of1296
+ Content History
+ Submissions
Submission DateSubmitterOrganization
2021-10-05CWE Content TeamMITRE
More information is available — Please select a different filter.
Page Last Updated: October 26, 2021