[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Portion of CWE structure

CWE - Common Weakness Enumeration

The Common Weakness Enumeration Specification (CWE) provides a common language of discourse for discussing, finding and dealing with the causes of software security vulnerabilities as they are found in code, design, or system architecture. Each individual CWE represents a single vulnerability type. CWE is currently maintained by the MITRE Corporation with support from the National Cyber Security Division (DHS). A detailed CWE list is currently available at the MITRE website; this list provides a detailed definition for each individual CWE.

All individual CWEs are held within a hierarchical structure that allows for multiple levels of abstraction. CWEs located at higher levels of the structure (i.e. Configuration) provide a broad overview of a vulnerability type and can have many children CWEs associated with them. CWEs at deeper levels in the structure (i.e. Cross Site Scripting) provide a finer granularity and usually have fewer or no children CWEs. The image to the right represents a portion of the overall CWE structure, the red boxes represent the CWEs being used by NVD. https://nvd.nist.gov/NVDLegacy/media/NVDLegacyMedia/CWE/cwe_cross_section_large.jpg

NVD integrates CWE into the scoring of CVE vulnerabilities by providing a cross section of the overall CWE structure. NVD analysts score CVEs using CWEs from different levels of the hierarchical structure. This cross section of CWEs allows analysts to score CVEs at both a fine and coarse granularity, which is necessary due to the varying levels of specificity possessed by different CVEs. The cross section of CWEs used by NVD is listed below; each CWE listed links to a detailed description hosted by MITRE. For a better understanding of how the standards link together please visit: MITRE - Making Security Measurable @ http://makingsecuritymeasurable.mitre.org/

CWE is not currently part of the Security Content Automation Protocol (SCAP). NVD is using CWE as a classification mechanism that differentiates CVEs by the type of vulnerability they represent.

Related Activities

The Software Assurance Metrics and Tool Evaluation (SAMATE) Project, NIST.

CWE Cross Section Mapped into by: NVD Name |	CWE-ID | Description

Authentication Issues

CWE-287 http://cwe.mitre.org/data/definitions/287.html -When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Buffer Errors

CWE-119 http://cwe.mitre.org/data/definitions/119.html -The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Code

CWE-17 http://cwe.mitre.org/data/definitions/17.html	-Weaknesses in this category are typically introduced during code development, including specification, design, and implementation.

Code Injection

CWE-94 http://cwe.mitre.org/data/definitions/94.html -The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Command Injection

CWE-77 http://cwe.mitre.org/data/definitions/77.html -The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Configuration

CWE-16 http://cwe.mitre.org/data/definitions/16.html -Weaknesses in this category are typically introduced during the configuration of the software.

Credentials Management

CWE-255 http://cwe.mitre.org/data/definitions/255.html -Weaknesses in this category are related to the management of credentials.

Cross-Site Request Forgery

(CSRF) CWE-352 http://cwe.mitre.org/data/definitions/352.html -The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Cross-Site Scripting (XSS)

CWE-79 http://cwe.mitre.org/data/definitions/79.html -The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Cryptographic Issues

CWE-310 http://cwe.mitre.org/data/definitions/310.html -Weaknesses in this category are related to the use of cryptography.

Data Handling

CWE-19 http://cwe.mitre.org/data/definitions/19.html	-Weaknesses in this category are typically found in functionality that processes data.

Format String Vulnerability

CWE-134 http://cwe.mitre.org/data/definitions/134.html -The software uses externally-controlled format strings in printf-style functions, which can lead to buffer overflows or data representation problems.

Improper Access Control

CWE-284 http://cwe.mitre.org/data/definitions/284.html -The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Indicator of Poor Code Quality

CWE-398 http://cwe.mitre.org/data/definitions/398.html -The code has features that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained.

Information Leak / Disclosure

CWE-200 http://cwe.mitre.org/data/definitions/200.html -An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.

Information Management Errors

CWE-199 http://cwe.mitre.org/data/definitions/199.html	-Weaknesses in this category are related to improper handling of sensitive information.

Injection

CWE-74 http://cwe.mitre.org/data/definitions/74.html	-The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Input Validation

CWE-20 http://cwe.mitre.org/data/definitions/20.html -The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

Insufficient Information

NVD-CWE-noinfo http://cwe.mitre.org/data/definitions/CWE-noinfo.html	-There is insufficient information about the issue to classify it; details are unkown or unspecified.

Insufficient Verification of Data Authenticity

CWE-345 http://cwe.mitre.org/data/definitions/345.html -The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Link Following

CWE-59 http://cwe.mitre.org/data/definitions/59.html -The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Location

CWE-1 http://cwe.mitre.org/data/definitions/1.html -Weaknesses in this category are organized based on which phase they are introduced during the software development and deployment process.

Numeric Errors

CWE-189 http://cwe.mitre.org/data/definitions/189.html -Weaknesses in this category are related to improper calculation or conversion of numbers.

OS Command Injections

CWE-78 http://cwe.mitre.org/data/definitions/78.html	-The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Other

NVD-CWE-Other http://cwe.mitre.org/data/definitions/CWE-Other.html	-NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.

Path Equivalence

CWE-21 http://cwe.mitre.org/data/definitions/21.html -Weaknesses in this category can be used to access files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence).

Path Traversal

CWE-22 http://cwe.mitre.org/data/definitions/22.html -The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Permissions, Privileges, and Access Control

CWE-264 http://cwe.mitre.org/data/definitions/264.html -Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Race Conditions

CWE-362 http://cwe.mitre.org/data/definitions/362.html -The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Resource Management Errors

CWE-399 http://cwe.mitre.org/data/definitions/399.html -Weaknesses in this category are related to improper management of system resources.

Security Features

CWE-254 http://cwe.mitre.org/data/definitions/254.html -Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Source Code

CWE-18 http://cwe.mitre.org/data/definitions/18.html -Weaknesses in this category are typically found within source code.

SQL Injection

CWE-89 http://cwe.mitre.org/data/definitions/89.html -The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Time and State

CWE-361 http://cwe.mitre.org/data/definitions/361.html -Weaknesses in this category are related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.