Skip to content

Commit 258e1d1

Browse files
david-a-wheelerdavid-a-wheeler
committed
Update CWE Top 25 table for 2021 edition
Update the CWE top 25 tables so they show the 2021 edition instead of the 2019 edition. Signed-off-by: David A. Wheeler <[email protected]>
1 parent 077a780 commit 258e1d1

File tree

1 file changed

+131
-131
lines changed

1 file changed

+131
-131
lines changed

‎secure_software_development_fundamentals.md

Lines changed: 131 additions & 131 deletions
Original file line numberDiff line numberDiff line change
@@ -4875,134 +4875,135 @@ No system is perfect. A complication is that the CWEs identified here are at var
48754875

48764876
<table>
48774877
<tr>
4878-
<td>Rank</td>
4879-
<td>ID</td>
4880-
<td>Name</td>
4878+
<td>Rank</td>
4879+
<td>ID</td>
4880+
<td>Name</td>
48814881
</tr>
48824882
<tr>
4883-
<td>[1]</td>
4884-
<td><a href="https://cwe.mitre.org/data/definitions/119.html">CWE-119</a></td>
4885-
<td>Improper Restriction of Operations within the Bounds of a Memory Buffer</td>
4883+
<td>[1]</td>
4884+
<td><a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787</a></td>
4885+
<td>Out-of-bounds Write</td>
48864886
</tr>
48874887
<tr>
4888-
<td>[2]</td>
4889-
<td><a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79</a></td>
4890-
<td>Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)</td>
4888+
<td>[2]</td>
4889+
<td><a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79</a></td>
4890+
<td>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</td>
48914891
</tr>
48924892
<tr>
4893-
<td>[3]</td>
4894-
<td><a href="https://cwe.mitre.org/data/definitions/20.html">CWE-20</a></td>
4895-
<td>Improper Input Validation</td>
4893+
<td>[3]</td>
4894+
<td><a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125</a></td>
4895+
<td>Out-of-bounds Read</td>
48964896
</tr>
48974897
<tr>
4898-
<td>[4]</td>
4899-
<td><a href="https://cwe.mitre.org/data/definitions/200.html">CWE-200</a></td>
4900-
<td>Information Exposure</td>
4898+
<td>[4]</td>
4899+
<td><a href="https://cwe.mitre.org/data/definitions/20.html">CWE-20</a></td>
4900+
<td>Improper Input Validation</td>
49014901
</tr>
49024902
<tr>
4903-
<td>[5]</td>
4904-
<td><a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125</a></td>
4905-
<td>Out-of-bounds Read</td>
4903+
<td>[5]</td>
4904+
<td><a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78</a></td>
4905+
<td>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')</td>
49064906
</tr>
49074907
<tr>
4908-
<td>[6]</td>
4909-
<td><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89</a></td>
4910-
<td>Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)</td>
4908+
<td>[6]</td>
4909+
<td><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89</a></td>
4910+
<td>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')</td>
49114911
</tr>
49124912
<tr>
4913-
<td>[7]</td>
4914-
<td><a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416</a></td>
4915-
<td>Use After Free</td>
4913+
<td>[7]</td>
4914+
<td><a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416</a></td>
4915+
<td>Use After Free</td>
49164916
</tr>
49174917
<tr>
4918-
<td>[8]</td>
4919-
<td><a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190</a></td>
4920-
<td>Integer Overflow or Wraparound</td>
4918+
<td>[8]</td>
4919+
<td><a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22</a></td>
4920+
<td>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</td>
49214921
</tr>
49224922
<tr>
4923-
<td>[9]</td>
4924-
<td><a href="https://cwe.mitre.org/data/definitions/352.html">CWE-352</a></td>
4925-
<td>Cross-Site Request Forgery (CSRF)</td>
4923+
<td>[9]</td>
4924+
<td><a href="https://cwe.mitre.org/data/definitions/352.html">CWE-352</a></td>
4925+
<td>Cross-Site Request Forgery (CSRF)</td>
49264926
</tr>
49274927
<tr>
4928-
<td>[10]</td>
4929-
<td><a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22</a></td>
4930-
<td>Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)</td>
4928+
<td>[10]</td>
4929+
<td><a href="https://cwe.mitre.org/data/definitions/434.html">CWE-434</a></td>
4930+
<td>Unrestricted Upload of File with Dangerous Type</td>
49314931
</tr>
49324932
<tr>
4933-
<td>[11]</td>
4934-
<td><a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78</a></td>
4935-
<td>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)</td>
4933+
<td>[11]</td>
4934+
<td><a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306</a></td>
4935+
<td>Missing Authentication for Critical Function</td>
49364936
</tr>
49374937
<tr>
4938-
<td>[12]</td>
4939-
<td><a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787</a></td>
4940-
<td>Out-of-bounds Write</td>
4938+
<td>[12]</td>
4939+
<td><a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190</a></td>
4940+
<td>Integer Overflow or Wraparound</td>
49414941
</tr>
49424942
<tr>
4943-
<td>[13]</td>
4944-
<td><a href="https://cwe.mitre.org/data/definitions/287.html">CWE-287</a></td>
4945-
<td>Improper Authentication</td>
4943+
<td>[13]</td>
4944+
<td><a href="https://cwe.mitre.org/data/definitions/502.html">CWE-502</a></td>
4945+
<td>Deserialization of Untrusted Data</td>
49464946
</tr>
49474947
<tr>
4948-
<td>[14]</td>
4949-
<td><a href="https://cwe.mitre.org/data/definitions/476.html">CWE-476</a></td>
4950-
<td>NULL Pointer Dereference</td>
4948+
<td>[14]</td>
4949+
<td><a href="https://cwe.mitre.org/data/definitions/287.html">CWE-287</a></td>
4950+
<td>Improper Authentication</td>
49514951
</tr>
49524952
<tr>
4953-
<td>[15]</td>
4954-
<td><a href="https://cwe.mitre.org/data/definitions/732.html">CWE-732</a></td>
4955-
<td>Incorrect Permission Assignment for Critical Resource</td>
4953+
<td>[15]</td>
4954+
<td><a href="https://cwe.mitre.org/data/definitions/476.html">CWE-476</a></td>
4955+
<td>NULL Pointer Dereference</td>
49564956
</tr>
49574957
<tr>
4958-
<td>[16]</td>
4959-
<td><a href="https://cwe.mitre.org/data/definitions/434.html">CWE-434</a></td>
4960-
<td>Unrestricted Upload of File with Dangerous Type</td>
4958+
<td>[16]</td>
4959+
<td><a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a></td>
4960+
<td>Use of Hard-coded Credentials</td>
49614961
</tr>
49624962
<tr>
4963-
<td>[17]</td>
4964-
<td><a href="https://cwe.mitre.org/data/definitions/611.html">CWE-611</a></td>
4965-
<td>Improper Restriction of XML External Entity Reference</td>
4963+
<td>[17]</td>
4964+
<td><a href="https://cwe.mitre.org/data/definitions/119.html">CWE-119</a></td>
4965+
<td>Improper Restriction of Operations within the Bounds of a Memory Buffer</td>
49664966
</tr>
49674967
<tr>
4968-
<td>[18]</td>
4969-
<td><a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94</a></td>
4970-
<td>Improper Control of Generation of Code (‘Code Injection’)</td>
4968+
<td>[18]</td>
4969+
<td><a href="https://cwe.mitre.org/data/definitions/862.html">CWE-862</a></td>
4970+
<td>Missing Authorization</td>
49714971
</tr>
49724972
<tr>
4973-
<td>[19]</td>
4974-
<td><a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a></td>
4975-
<td>Use of Hard-coded Credentials</td>
4973+
<td>[19]</td>
4974+
<td><a href="https://cwe.mitre.org/data/definitions/276.html">CWE-276</a></td>
4975+
<td>Incorrect Default Permissions</td>
49764976
</tr>
49774977
<tr>
4978-
<td>[20]</td>
4979-
<td><a href="https://cwe.mitre.org/data/definitions/400.html">CWE-400</a></td>
4980-
<td>Uncontrolled Resource Consumption</td>
4978+
<td>[20]
4979+
</td>
4980+
<td><a href="https://cwe.mitre.org/data/definitions/200.html">CWE-200</a></td>
4981+
<td>Exposure of Sensitive Information to an Unauthorized Actor</td>
49814982
</tr>
49824983
<tr>
4983-
<td>[21]</td>
4984-
<td><a href="https://cwe.mitre.org/data/definitions/772.html">CWE-772</a></td>
4985-
<td>Missing Release of Resource after Effective Lifetime</td>
4984+
<td>[21]</td>
4985+
<td><a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522</a></td>
4986+
<td>Insufficiently Protected Credentials</td>
49864987
</tr>
49874988
<tr>
4988-
<td>[22]</td>
4989-
<td><a href="https://cwe.mitre.org/data/definitions/426.html">CWE-426</a></td>
4990-
<td>Untrusted Search Path</td>
4989+
<td>[22]</td>
4990+
<td><a href="https://cwe.mitre.org/data/definitions/732.html">CWE-732</a></td>
4991+
<td>Incorrect Permission Assignment for Critical Resource</td>
49914992
</tr>
49924993
<tr>
4993-
<td>[23]</td>
4994-
<td><a href="https://cwe.mitre.org/data/definitions/502.html">CWE-502</a></td>
4995-
<td>Deserialization of Untrusted Data</td>
4994+
<td>[23]</td>
4995+
<td><a href="https://cwe.mitre.org/data/definitions/611.html">CWE-611</a></td>
4996+
<td>Improper Restriction of XML External Entity Reference</td>
49964997
</tr>
49974998
<tr>
4998-
<td>[24]</td>
4999-
<td><a href="https://cwe.mitre.org/data/definitions/269.html">CWE-269</a></td>
5000-
<td>Improper Privilege Management</td>
4999+
<td>[24]</td>
5000+
<td><a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918</a></td>
5001+
<td>Server-Side Request Forgery (SSRF)</td>
50015002
</tr>
50025003
<tr>
5003-
<td>[25]</td>
5004-
<td><a href="https://cwe.mitre.org/data/definitions/295.html">CWE-295</a></td>
5005-
<td>Improper Certificate Validation</td>
5004+
<td>[25]</td>
5005+
<td><a href="https://cwe.mitre.org/data/definitions/77.html">CWE-77</a></td>
5006+
<td>Improper Neutralization of Special Elements used in a Command ('Command Injection')</td>
50065007
</tr>
50075008
</table>
50085009

@@ -5011,92 +5012,91 @@ No system is perfect. A complication is that the CWEs identified here are at var
50115012

50125013
The developers of the CWE Top 25 felt that there were a number of weaknesses that were important, but did not manage to be in their top 25 because they were not as prevalent or tended to be less severe. They call these weaknesses *on the cusp*.
50135014

5014-
Developers that complete mitigation and risk decision-making on the 2019 CWE Top 25 may want to look for these other weaknesses potentially present in their software. For these reasons, users of the 2019 CWE Top 25 should seriously consider including these additional weaknesses in their analyses:
5015+
Developers that complete mitigation and risk decision-making on the 2021 CWE Top 25 may want to look for these other weaknesses potentially present in their software. For these reasons, users of the 2021 CWE Top 25 should seriously consider including these additional weaknesses in their analyses:
50155016

50165017
<table>
50175018
<tr>
5018-
<td>Rank</td>
5019-
<td>ID</td>
5020-
<td>Name</td>
5019+
<td>Rank</td>
5020+
<td>ID</td>
5021+
<td>Name</td>
50215022
</tr>
50225023
<tr>
5023-
<td>[26]</td>
5024-
<td><a href="https://cwe.mitre.org/data/definitions/835.html">CWE-835</a></td>
5025-
<td>Loop with Unreachable Exit Condition (‘Infinite Loop’)</td>
5024+
<td>[26]</td>
5025+
<td><a href="https://cwe.mitre.org/data/definitions/295.html">CWE-295</a></td>
5026+
<td>Improper Certificate Validation</td>
50265027
</tr>
50275028
<tr>
5028-
<td>[27]</td>
5029-
<td><a href="https://cwe.mitre.org/data/definitions/522.html">CWE-522</a></td>
5030-
<td>Insufficiently Protected Credentials</td>
5029+
<td>[27]</td>
5030+
<td><a href="https://cwe.mitre.org/data/definitions/400.html">CWE-400</a></td>
5031+
<td>Uncontrolled Resource Consumption</td>
50315032
</tr>
50325033
<tr>
5033-
<td>[28]</td>
5034-
<td><a href="https://cwe.mitre.org/data/definitions/704.html">CWE-704</a></td>
5035-
<td>Incorrect Type Conversion or Cast</td>
5034+
<td>[28]</td>
5035+
<td><a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94</a></td>
5036+
<td>Improper Control of Generation of Code ('Code Injection')</td>
50365037
</tr>
50375038
<tr>
5038-
<td>[29]</td>
5039-
<td><a href="https://cwe.mitre.org/data/definitions/362.html">CWE-362</a></td>
5040-
<td>Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)</td>
5039+
<td>[29]</td>
5040+
<td><a href="https://cwe.mitre.org/data/definitions/269.html">CWE-269</a></td>
5041+
<td>Improper Privilege Management</td>
50415042
</tr>
50425043
<tr>
5043-
<td>[30]</td>
5044-
<td><a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918</a></td>
5045-
<td>Server-Side Request Forgery (SSRF)</td>
5044+
<td>[30]</td>
5045+
<td><a href="https://cwe.mitre.org/data/definitions/917.html">CWE-917</a></td>
5046+
<td>Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')</td>
50465047
</tr>
50475048
<tr>
5048-
<td>[31]</td>
5049-
<td><a href="https://cwe.mitre.org/data/definitions/415.html">CWE-415</a></td>
5050-
<td>Double Free</td>
5049+
<td>[31]</td>
5050+
<td><a href="https://cwe.mitre.org/data/definitions/59.html">CWE-59</a></td>
5051+
<td>Improper Link Resolution Before File Access ('Link Following')</td>
50515052
</tr>
50525053
<tr>
5053-
<td>[32]</td>
5054-
<td><a href="https://cwe.mitre.org/data/definitions/601.html">CWE-601</a></td>
5055-
<td>URL Redirection to Untrusted Site (‘Open Redirect’)</td>
5054+
<td>[32]</td>
5055+
<td><a href="https://cwe.mitre.org/data/definitions/401.html">CWE-401</a></td>
5056+
<td>Missing Release of Memory after Effective Lifetime</td>
50565057
</tr>
50575058
<tr>
5058-
<td>[33]</td>
5059-
<td><a href="https://cwe.mitre.org/data/definitions/863.html">CWE-863</a></td>
5060-
<td>Incorrect Authorization</td>
5059+
<td>[33]</td>
5060+
<td><a href="https://cwe.mitre.org/data/definitions/362.html">CWE-362</a></td>
5061+
<td>Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')</td>
50615062
</tr>
50625063
<tr>
5063-
<td>[34]</td>
5064-
<td><a href="https://cwe.mitre.org/data/definitions/862.html">CWE-862</a></td>
5065-
<td>Missing Authorization</td>
5064+
<td>[34]</td>
5065+
<td><a href="https://cwe.mitre.org/data/definitions/427.html">CWE-427</a></td>
5066+
<td>Uncontrolled Search Path Element</td>
50665067
</tr>
50675068
<tr>
5068-
<td>[35]</td>
5069-
<td><a href="https://cwe.mitre.org/data/definitions/532.html">CWE-532</a></td>
5070-
<td>Inclusion of Sensitive Information in Log Files</td>
5069+
<td>[35]</td>
5070+
<td><a href="https://cwe.mitre.org/data/definitions/319.html">CWE-319</a></td>
5071+
<td>Cleartext Transmission of Sensitive Information</td>
50715072
</tr>
50725073
<tr>
5073-
<td>[36]</td>
5074-
<td><a href="https://cwe.mitre.org/data/definitions/306.html">CWE-306</a></td>
5075-
<td>Missing Authentication for Critical Function</td>
5074+
<td>[36]</td>
5075+
<td><a href="https://cwe.mitre.org/data/definitions/843.html">CWE-843</a></td>
5076+
<td>Access of Resource Using Incompatible Type ('Type Confusion')</td>
50765077
</tr>
50775078
<tr>
5078-
<td>[37]</td>
5079-
<td><a href="https://cwe.mitre.org/data/definitions/384.html">CWE-384</a></td>
5080-
<td>Session Fixation</td>
5079+
<td>[37]</td>
5080+
<td><a href="https://cwe.mitre.org/data/definitions/601.html">CWE-601</a></td>
5081+
<td>URL Redirection to Untrusted Site ('Open Redirect')</td>
50815082
</tr>
50825083
<tr>
5083-
<td>[38]</td>
5084-
<td><a href="https://cwe.mitre.org/data/definitions/326.html">CWE-326</a></td>
5085-
<td>Inadequate Encryption Strength</td>
5084+
<td>[38]</td>
5085+
<td><a href="https://cwe.mitre.org/data/definitions/863.html">CWE-863</a></td>
5086+
<td>Incorrect Authorization</td>
50865087
</tr>
50875088
<tr>
5088-
<td>[39]</td>
5089-
<td><a href="https://cwe.mitre.org/data/definitions/770.html">CWE-770</a></td>
5090-
<td>Allocation of Resources Without Limits or Throttling</td>
5089+
<td>[39]</td>
5090+
<td><a href="https://cwe.mitre.org/data/definitions/532.html">CWE-532</a></td>
5091+
<td>Inclusion of Sensitive Information in Log Files</td>
50915092
</tr>
50925093
<tr>
5093-
<td>[40]</td>
5094-
<td><a href="https://cwe.mitre.org/data/definitions/617.html">CWE-617</a></td>
5095-
<td>Reachable Assertion</td>
5094+
<td>[40]</td>
5095+
<td><a href="https://cwe.mitre.org/data/definitions/770.html">CWE-770</a></td>
5096+
<td>Allocation of Resources Without Limits or Throttling</td>
50965097
</tr>
50975098
</table>
50985099

5099-
51005100
You will be glad to know that this set of courses has, at least briefly, discussed each one of these kinds of vulnerabilities, even the ones “on the cusp”,
51015101
for both the [2019](https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html) and [2021](https://cwe.mitre.org/top25/archive/2021/2021_cwe_top25.html) editions of the CWE Top 25 list.
51025102

@@ -5173,13 +5173,13 @@ Many others discuss how to develop secure software. This course merely covers th
51735173

51745174
## OWASP Top 10 and CWE Top 25
51755175

5176-
### CWE Top 25
5176+
### CWE Top 25 (2019 edition)
51775177

51785178
Here is the 2019 edition of the [CWE Top 25 Most Dangerous Software Errors](https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html). This list was created using real-world data, specifically, the publicly known vulnerabilities with Common Vulnerabilities and Exposures (CVE) as published in the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), including the severity scores as calculated using the Common Vulnerability Scoring System (CVSS) scores. This list combines many different kinds of software; whether or not that is good depends on your perspective.
51795179

51805180
No system is perfect. A complication is that the CWEs identified here are at various hierarchical levels. For example, #1 [CWE-119](https://cwe.mitre.org/data/definitions/119.html) (*Improper Restriction of Operations within the Bounds of a Memory Buffer*) is a superset of both #5 [CWE-125](https://cwe.mitre.org/data/definitions/125.html) (*Out-of-bounds read*) and #12 [CWE-787](https://cwe.mitre.org/data/definitions/787.html) (*Out-of-bounds Write*), yet they are all listed here. Still, this does provide a defensible and repeatable approach for identifying what’s important.
51815181

5182-
#### Top 25
5182+
#### Top 25 (2019)
51835183

51845184
<table>
51855185
<tr>
@@ -5317,7 +5317,7 @@ No system is perfect. A complication is that the CWEs identified here are at var
53175317
Ones marked with (!) are in the 2019 edition but not the 2021 edition.
53185318

53195319

5320-
#### On the Cusp
5320+
#### On the Cusp (2019)
53215321

53225322
The developers of the CWE Top 25 felt that there were a number of weaknesses that were important, but did not manage to be in their top 25 because they were not as prevalent or tended to be less severe. They call these weaknesses *on the cusp*.
53235323

0 commit comments

Comments
 (0)