Common Weakness Enumeration
_logo.svg){kind=link}
The Common Weakness Enumeration (CWE) is a category system for hardware and software weaknesses and vulnerabilities. It is sustained by a community project with the goals of understanding flaws in software and hardware and creating automated tools that can be used to identify, fix, and prevent those flaws.[1] The project is sponsored by the office of the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), which is operated by The MITRE Corporation,[2] with support from US-CERT and the National Cyber Security Division of the U.S. Department of Homeland Security.[3] [4]
The first release of the list and associated classification taxonomy was in 2006.[5] Version 4.15 of the CWE standard was released in July 2024.[6]
CWE has over 600 categories, including classes for buffer overflows, path/directory tree traversal errors, race conditions, cross-site scripting, hard-coded passwords, and insecure random numbers.[7]
Examples
[edit ]- CWE category 121 is for stack-based buffer overflows.[8]
CWE compatibility
[edit ]Common Weakness Enumeration (CWE) Compatibility program allows a service or a product to be reviewed and registered as officially "CWE-Compatible" and "CWE-Effective". The program assists organizations in selecting the right software tools and learning about possible weaknesses and their possible impact.
In order to obtain CWE Compatible status a product or a service must meet 4 out of 6 requirements, shown below:
There are 56 organizations as of September 2019 that develop and maintain products and services that achieved CWE Compatible status.[9]
Research, critiques, and new developments
[edit ]Some researchers think that ambiguities in CWE can be avoided or reduced.[10]
As of 4/16/2024, the CWE Compatibility Program has been discontinued.[11]
See also
[edit ]- Common Vulnerabilities and Exposures (CVE)
- Common Vulnerability Scoring System (CVSS)
- National Vulnerability Database
References
[edit ]- ^ "CWE - About CWE". at mitre.org.
- ^ "CWE - Frequently Asked Questions (FAQ)". cwe.mitre.org. Retrieved 2023年09月21日.
- ^ "Vulnerabilities | NVD CWE Slice". National Vulnerability Database .
- ^ Goseva-Popstojanova, Katerina; Perhinschi, Andrei (2015). "On the capability of static code analysis to detect security vulnerabilities" . Information and Software Technology. 68: 18–33. doi:10.1016/j.infsof.201508002.
- ^ "CWE - About - CWE History". cwe.mitre.org. Retrieved 2025年02月18日.
- ^ "CWE Version 4.15 Now Available". Mitre Corporation . Retrieved 17 October 2024.
- ^ Bojanova, Irena (2014). "Bugs Framework (BF): Formalizing Software Security Weaknesses and Vulnerabilities". samate.nist.gov.
- ^ "CWE - CWE-121: Stack-based Buffer Overflow (4.15)". cwe.mitre.org. Retrieved August 5, 2024.
- ^ "CWE - CWE-Compatible Products and Services". at mitre.org.
- ^ Paul E. Black; Irena V. Bojanova; Yaacov Yesha; Yan Wu (2015). "Towards a "Periodic Table" of Bugs". National Institute of Standards and Technology .
- ^ "CWE-Compatible Products and Services". Common Weakness Enumeration. Archived from the original on 2025年01月07日.
External links
[edit ]- Certifying Applications for Known Security Weaknesses. The Common Weakness Enumeration (CWE) Effort // 6 March 2007
- "Classes of Vulnerabilities and Attacks" (PDF). Wiley Handbook of Science and Technology for Homeland Security. comparison of different vulnerability Classifications. Archived from the original (PDF) on 2016年03月22日.
{{cite web}}: CS1 maint: others (link)