common weakness enumeration (CWE)
What is CWE?
CWE stands for Common Weakness Enumeration. It is a community-developed list of common software and hardware security weaknesses maintained by MITRE. The CWE list provides a standardized language and framework for identifying, categorizing, and understanding flaws that may lead to exploitable vulnerabilities in applications and systems.
Why CWE matters
CWE is an essential tool for developers, security teams, and software vendors to:
- Improve code quality by understanding and mitigating common flaws
- Develop secure software through education and secure coding practices
- Align with standards and compliance frameworks, like those from NIST
Examples of common CWEs
Here are a few notable entries from the CWE list:
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-287: Improper Authentication
- CWE-22: Path Traversal
- CWE-732: Incorrect Permission Assignment for Critical Resource
Each entry in the CWE list includes a unique ID, description, potential consequences, and links to real-world CVEs (Common Vulnerabilities and Exposures) that stem from that weakness.
CWE vs. CVE
While both are managed by MITRE, they serve different purposes:
- CWE focuses on the types of weaknesses that lead to vulnerabilities
- CVE catalogs specific vulnerabilities found in real-world software and systems
Think of CWE as the "root cause" database, and CVE as the list of real-world security incidents.
