2024 “On the Cusp” Weaknesses InsightsThe 2024 CWE Top 25 Most Dangerous Software Weaknesses list is a practical and convenient resource to help mitigate software security risk. But the complete dataset analyzed had 128 total weaknesses that were recorded, analyzed, and ranked. Beyond the Top 25, those performing mitigation and risk decision-making should consider these additional “On-the-Cusp” weaknesses in their efforts as they too can become severe, exploitable vulnerabilities under the right conditions. AnalysisThe On-the-Cusp list comprises CWEs ranked in positions 26-40, per the 2024 CWE Top 25 Methodology. These CWEs continue to be prevalent and the root cause of vulnerabilities severe enough to raise concern. Five CWEs have increased in rank to move them into this year’s On the Cusp list:
Two CWEs that were on the 2023 CWE Top 25 list dropped to the 2024 On-the-Cusp list:
Five CWEs that were on the 2023 On-the-Cusp list dropped out of this year’s On-the-Cusp list altogether (dropping to a position below the rank 40):
Mapping UsageThere were 2,042 individual vulnerability mappings to the 2024 “On-the-Cusp” CWEs in this year’s list. Every CWE is annotated with a “mapping usage recommendation” that suggests whether the CWE should be used for vulnerability root cause mapping given its level of abstraction and actionability. The CWEs in the 2024 On-the-Cusp list had the following mapping usage recommendations:
In contrast, last year’s 2023 On-the-Cusp list had the following mapping usage recommendations from 3,416 individual mappings:
AbstractionCWE contains over 900 weaknesses that range from abstract and conceptual to precise and technology- or language-specific. A precise weakness will have a “parent” weakness that is more abstract, which may also have “parent” weaknesses, and so on. There are four types of weakness abstractions, from most abstract to most specific: Pillar, Class, Base, and Variant. For root cause mapping, CWE’s root cause mapping guidance recommends that Base and Variant level CWEs should be used whenever possible to ensure providing adequate specificity, actionability, and root cause information for a vulnerability. Class level CWEs may be used for root cause mapping if there is no accurate Base or Variant level CWE. Number of CWEs per level of abstraction (2024 On-the-Cusp):
Number of CWEs per level of abstraction (2023 On-the-Cusp):
Possible Factors in Ranking ShiftsAs described in the Top 25 Insights, the introduction of a new methodology likely changed many rankings compared to last year’s list. In previous years, CWE Team members attempted to re-analyze all CVEs with mappings to high-level classes (such as CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) or clear keyword matches (suggesting mappings to more specific weaknesses such as CWE-617: Reachable Assertion or CWE-401: Missing Release of Memory after Effective Lifetime). CWE Team members often changed such mappings to more accurate, precise CWE IDs. The lack of chain analysis also may have contributed to the decline in some CWEs such as CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). There may be other factors unrelated to the methodology changes, such as improvements in tooling or other methods for detecting certain weaknesses, researchers prioritizing the investigation of some weaknesses over others, changes in CWE mapping practices, and the increase in certain weaknesses being introduced. |
