CWEs vs OWASP top 10?
Tags: codenewbie, security, owasp, cwe
Published: 2020-07-25 21:38:12

In security land there are weakness always being found. __Nothing is ever 100% secure.__
Because of this it can be difficult to be on the same page when discussing importance of issues to fix/how and there is a need for a common language to communicate and measure security tools for baseline weakness identification, mitigation, and prevention.

There are a few entities that appear when talking about top security issue lists on the web, but the most common are CWE (Common Weakness Enumeration) and OWASP (Open Web Application Security Project) where each company creates their own list of the top vulnerabilities each year-ish. (CWE says it's updates yearly but it's still only listing 2019)






# What is a CWE?
The Common Weakness Enumeration (CWE™) is a list/dictionary composed of common software and hardware weaknesses that can be found in architecture, design, code, or implementation that can lead to exploitable security vulnerabilities. (1) It is made by a community of industry leaders who contribute to vulnerability disclosure and standards.




# What is covered on the CWE top list?
The CWE list is interesting because it covers software and hardware issues. The list is constructed after determining the frequency and projected severity of each CWE and the list of the top 25 are published yearly.

### CWE 2019 top 25 Most Dangerous Software Errors:
| Rank | ID | Name | Score |
| --- | --- | --- | --- |
| **[1]** | [CWE-119](https://cwe.mitre.org/data/definitions/119.html) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 75.56 |
| **[2]** | [CWE-79](https://cwe.mitre.org/data/definitions/79.html) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 45.69 |
| **[3]** | [CWE-20](https://cwe.mitre.org/data/definitions/20.html) | Improper Input Validation | 43.61 |
| **[4]** | [CWE-200](https://cwe.mitre.org/data/definitions/200.html) | Information Exposure | 32.12 |
| **[5]** | [CWE-125](https://cwe.mitre.org/data/definitions/125.html) | Out-of-bounds Read | 26.53 |
| **[6]** | [CWE-89](https://cwe.mitre.org/data/definitions/89.html) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 24.54 |
| **[7]** | [CWE-416](https://cwe.mitre.org/data/definitions/416.html) | Use After Free | 17.94 |
| **[8]** | [CWE-190](https://cwe.mitre.org/data/definitions/190.html) | Integer Overflow or Wraparound | 17.35 |
| **[9]** | [CWE-352](https://cwe.mitre.org/data/definitions/352.html) | Cross-Site Request Forgery (CSRF) | 15.54 |
| **[10]** | [CWE-22](https://cwe.mitre.org/data/definitions/22.html) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 14.10 |
| **[11]** | [CWE-78](https://cwe.mitre.org/data/definitions/78.html) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 11.47 |
| **[12]** | [CWE-787](https://cwe.mitre.org/data/definitions/787.html) | Out-of-bounds Write | 11.08 |
| **[13]** | [CWE-287](https://cwe.mitre.org/data/definitions/287.html) | Improper Authentication | 10.78 |
| **[14]** | [CWE-476](https://cwe.mitre.org/data/definitions/476.html) | NULL Pointer Dereference | 9.74 |
| **[15]** | [CWE-732](https://cwe.mitre.org/data/definitions/732.html) | Incorrect Permission Assignment for Critical Resource | 6.33 |
| **[16]** | [CWE-434](https://cwe.mitre.org/data/definitions/434.html) | Unrestricted Upload of File with Dangerous Type | 5.50 |
| **[17]** | [CWE-611](https://cwe.mitre.org/data/definitions/611.html) | Improper Restriction of XML External Entity Reference | 5.48 |
| **[18]** | [CWE-94](https://cwe.mitre.org/data/definitions/94.html) | Improper Control of Generation of Code ('Code Injection') | 5.36 |
| **[19]** | [CWE-798](https://cwe.mitre.org/data/definitions/798.html) | Use of Hard-coded Credentials | 5.12 |
| **[20]** | [CWE-400](https://cwe.mitre.org/data/definitions/400.html) | Uncontrolled Resource Consumption | 5.04 |
| **[21]** | [CWE-772](https://cwe.mitre.org/data/definitions/772.html) | Missing Release of Resource after Effective Lifetime | 5.04 |
| **[22]** | [CWE-426](https://cwe.mitre.org/data/definitions/426.html) | Untrusted Search Path | 4.40 |
| **[23]** | [CWE-502](https://cwe.mitre.org/data/definitions/502.html) | Deserialization of Untrusted Data | 4.30 |
| **[24]** | [CWE-269](https://cwe.mitre.org/data/definitions/269.html) | Improper Privilege Management | 4.23 |
| **[25]** | [CWE-295](https://cwe.mitre.org/data/definitions/295.html) | Improper Certificate Validation | 4.06 |







# What is OWASP?
The OWASP® Foundation is a nonprofit foundation that works to improve the security of software, though its wide network of members on community-led open source software projects. (3)






# What is covered on the OWASP top 10 list?
The OWASP Top 10 is a standard awareness document for developers and __web application__ security and represents a broad consensus about the most critical security risks to web applications.


### 2020 OWASP TOP 10 Vulnerabilities:
| ID | Name |
| --- | --- |
| [A1](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A1-Injection) | Injection |
| [A2](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A2-Broken_Authentication) | Broken Authentication |
| [A3](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A3-Sensitive_Data_Exposure) | Sensitive Data Exposure |
| [A4](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A4-XML_External_Entities_(XXE)) | XML External Entities (XXE) |
| [A5](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A5-Broken_Access_Control) | Broken Access Control |
| [A6](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A6-Security_Misconfiguration) | Security Misconfiguration |
| [A7](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A7-Cross-Site_Scripting_(XSS)) | Cross Site Scripting (XSS) |
| [A8](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A8-Insecure_Deserialization) | Insecure Deserialization |
| [A9](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities) | Using Components with Known Vulnerabilities |
| [A10](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A10-Insufficient_Logging%252526Monitoring) | Insufficient Logging & Monitoring |




# What is the difference?
The difference is in the details. OWASP top 10 is the main category and the CWE is a break down to each issue.
However, as you can see below, CWEs will have some issues that don't fall into any of the 10 categories of the OWASP top 10 because CWEs cover software issues and not just web application specific.


<table>
<thead>
  <tr>
    <th>OWASP Top 10</th>
    <th>CWE 25</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td>A1: Injection</td>
    <td><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank" rel="noopener noreferrer">CWE-78</a>: Improper Neutralization of Special Elements Used in an OS Command (‘OS Command Injection’)<br><a href="https://cwe.mitre.org/data/definitions/89.html" target="_blank" rel="noopener noreferrer">CWE-89</a>: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')<br><a href="https://cwe.mitre.org/data/definitions/94.html" target="_blank" rel="noopener noreferrer">CWE-94</a>: Improper Control of Generation of Code ('Code Injection')<br><a href="https://cwe.mitre.org/data/definitions/434.html" target="_blank" rel="noopener noreferrer">CWE-434</a>: Unrestricted Upload of File with Dangerous Type</td>
  </tr>
  <tr>
    <td>A2: Broken Authentication</td>
    <td><a href="https://cwe.mitre.org/data/definitions/798.html" target="_blank" rel="noopener noreferrer">CWE-798</a>: Use of Hard-coded Credentials</td>
  </tr>
  <tr>
    <td>A3: Sensitive Data Exposure</td>
    <td><a href="https://cwe.mitre.org/data/definitions/200.html" target="_blank" rel="noopener noreferrer">CWE-200</a>: Information Exposure</td>
  </tr>
  <tr>
    <td>A4: XML External Entities</td>
    <td>None</td>
  </tr>
  <tr>
    <td>A5: Broken Access Control</td>
    <td>None<br></td>
  </tr>
  <tr>
    <td>A6: Security Misconfiguration</td>
    <td><a href="https://cwe.mitre.org/data/definitions/732.html" target="_blank" rel="noopener noreferrer">CWE-732</a>: Incorrect Permission Assignment for Critical Resource<br></td>
  </tr>
  <tr>
    <td>A7: Cross-Site Scripting (XSS)</td>
    <td><a href="https://cwe.mitre.org/data/definitions/79.html" target="_blank" rel="noopener noreferrer">CWE-79</a>: Improper Neutralization of Input During Web Page Generation ('Cross-Site Scripting')</td>
  </tr>
  <tr>
    <td>A8: Insecure Deserialization</td>
    <td>None</td>
  </tr>
  <tr>
    <td>A9: Using Components with Known Vulnerabilities</td>
    <td><a href="https://cwe.mitre.org/data/definitions/190.html" target="_blank" rel="noopener noreferrer">CWE-190</a>: Integer Overflow or Wraparound</td>
  </tr>
  <tr>
    <td>A10: Insufficient Logging and Monitoring</td>
    <td>None</td>
  </tr>
  <tr>
    <td>Other</td>
    <td><a href="https://cwe.mitre.org/data/definitions/119.html" target="_blank" rel="noopener noreferrer">CWE-119</a>: Improper Restriction of Operations within the Bounds of a Memory Buffer<br><a href="https://cwe.mitre.org/data/definitions/20.html" target="_blank" rel="noopener noreferrer">CWE-20</a>: Improper Input Validation<br><a href="https://cwe.mitre.org/data/definitions/125.html" target="_blank" rel="noopener noreferrer">CWE-125</a>: Out-of-bounds Read<br><a href="https://cwe.mitre.org/data/definitions/416.html" target="_blank" rel="noopener noreferrer">CWE-416</a>: Use After Free<br><a href="https://cwe.mitre.org/data/definitions/352.html" target="_blank" rel="noopener noreferrer">CWE-352</a>: Cross-Site Request Forgery (CSRF)<br><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank" rel="noopener noreferrer">CWE-22</a>: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')<br><a href="https://cwe.mitre.org/data/definitions/787.html" target="_blank" rel="noopener noreferrer">CWE-787</a>: Out-of-bounds Write<br><a href="https://cwe.mitre.org/data/definitions/287.html" target="_blank" rel="noopener noreferrer">CWE-287</a>: Improper Authentication<br><a href="https://cwe.mitre.org/data/definitions/476.html" target="_blank" rel="noopener noreferrer">CWE-476</a>: NULL Pointer Dereference<br><a href="https://cwe.mitre.org/data/definitions/611.html" target="_blank" rel="noopener noreferrer">CWE-611</a>: Improper Restriction of XML External Entity Reference<br><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank" rel="noopener noreferrer">CWE-400</a>: Uncontrolled Resource Consumption<br><a href="https://cwe.mitre.org/data/definitions/772.html" target="_blank" rel="noopener noreferrer">CWE-772</a>: Missing Release of Resource after Effective Lifetime<br><a href="https://cwe.mitre.org/data/definitions/426.html" target="_blank" rel="noopener noreferrer">CWE-426</a>: Untrusted Search Path<br><a href="https://cwe.mitre.org/data/definitions/502.html" target="_blank" rel="noopener noreferrer">CWE-502</a>: Deserialization of Untrusted Data<br><a href="https://cwe.mitre.org/data/definitions/269.html" target="_blank" rel="noopener noreferrer">CWE-269</a>: Improper Privilege Management<br><a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener noreferrer">CWE-295</a>: Improper Certificate Validation</td>
  </tr>
</tbody>
</table>






# Is one better than the other to use?
Nope. These lists were developed to help developers focus on the bigger issues that could cause more damage to the application they are working on.
If anything, using both lists together is a better idea because the OWASP is more board and the CVE can make an issue more focused within the broad topics of the OWASP top 10 for better mitigation.







<hr>

#### References 
1. https://cwe.mitre.org/about/faq.html#what_is_cwe_weakness_meaning
2. https://owasp.org/www-project-top-ten/
3. https://owasp.org/


###### Please Note that I am still learning and if something that I have stated is incorrect please let me know. I would love to learn more about what I may not understand fully.