CWE - CWE-2: CWE CATEGORY: 7PK - Environment (4.18)

Home > CWE List > CWE- Individual Dictionary Definition (4.18)

CWE Glossary Definition

CWE CATEGORY: 7PK - Environment

Category ID: 2

Vulnerability Mapping: PROHIBITED This CWE ID must not be used to map to real-world vulnerabilities

Summary

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

Membership

Nature	Type	ID	Name
MemberOf	ViewView - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	700	Seven Pernicious Kingdoms
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	933	OWASP Top Ten 2013 Category A5 - Security Misconfiguration
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	1349	OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	5	J2EE Misconfiguration: Data Transmission Without Encryption
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	6	J2EE Misconfiguration: Insufficient Session-ID Length
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	7	J2EE Misconfiguration: Missing Custom Error Page
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	8	J2EE Misconfiguration: Entity Bean Declared Remote
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	9	J2EE Misconfiguration: Weak Access Permissions for EJB Methods
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	11	ASP.NET Misconfiguration: Creating Debug Binary
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	12	ASP.NET Misconfiguration: Missing Custom Error Page
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	13	ASP.NET Misconfiguration: Password in Configuration File
HasMember	VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.	14	Compiler Removal of Code to Clear Buffers

Vulnerability Mapping Notes

Usage: PROHIBITED

(this CWE ID must not be used to map to real-world vulnerabilities)

Reason: Category

Rationale:

This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.

Comments:

See member weaknesses of this category.

References

[REF-6] Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools Techniques and Metrics. NIST. 2005年11月07日. <https://samate.nist.gov/SSATTM_Content/papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf>.

Content History

Submissions
Submission Date	Submitter	Organization
2006年07月19日 (CWE Draft 3, 2006年07月19日)	7 Pernicious Kingdoms
2006年07月19日 (CWE Draft 3, 2006年07月19日)
Modifications
Modification Date	Modifier	Organization
2008年09月08日	CWE Content Team	MITRE
2008年09月08日	updated Relationships
2013年07月17日	CWE Content Team	MITRE
2013年07月17日	updated Relationships
2015年12月07日	CWE Content Team	MITRE
2015年12月07日	updated Relationships
2017年01月19日	CWE Content Team	MITRE
2017年01月19日	updated Maintenance_Notes, Relationships
2017年11月08日	CWE Content Team	MITRE
2017年11月08日	updated Description, Maintenance_Notes, Name
2018年03月27日	CWE Content Team	MITRE
2018年03月27日	updated Relationships
2019年06月20日	CWE Content Team	MITRE
2019年06月20日	updated Relationships
2020年02月24日	CWE Content Team	MITRE
2020年02月24日	updated References
2021年10月28日	CWE Content Team	MITRE
2021年10月28日	updated Relationships
2023年04月27日	CWE Content Team	MITRE
2023年04月27日	updated Mapping_Notes
2023年06月29日	CWE Content Team	MITRE
2023年06月29日	updated Mapping_Notes
Previous Entry Names
Change Date	Previous Entry Name
2017年11月08日	Environment

More information is available — Please edit the custom filter or select a different filter.

Page Last Updated: September 09, 2025

MITRE

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2025, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.

HSSEDI