日本語

CWE-711 ビュー詳細

CWE-711

Weaknesses in OWASP Top Ten (2004)
2008-08-15 +00:00
Obsolete
Graph
2023-06-29 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Weaknesses in OWASP Top Ten (2004)

CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top Ten is available.

CWE メンバー

CWE-731: Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2004.
CWE-209: Generation of Error Message Containing Sensitive Information ベース
CWE-215: Insertion of Sensitive Information Into Debugging Code ベース
CWE-219: Storage of File with Sensitive Data Under Web Root ベース
CWE-275: Permission Issues カテゴリ
CWE-295: Improper Certificate Validation ベース
CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption ベース
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File ベース
CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length ベース
CWE-7: J2EE Misconfiguration: Missing Custom Error Page ベース
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote ベース
CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods ベース
CWE-459: Incomplete Cleanup ベース
CWE-489: Active Debug Code ベース
CWE-11: ASP.NET Misconfiguration: Creating Debug Binary ベース
CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page ベース
CWE-13: ASP.NET Misconfiguration: Password in Configuration File ベース
CWE-520: .NET Misconfiguration: Use of Impersonation ベース
CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework ベース
CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation ベース
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable ベース
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere ベース
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere ベース
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere ベース
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere ベース
CWE-531: Inclusion of Sensitive Information in Test Code ベース
CWE-532: Insertion of Sensitive Information into Log File ベース
CWE-540: Inclusion of Sensitive Information in Source Code ベース
CWE-541: Inclusion of Sensitive Information in an Include File ベース
CWE-548: Exposure of Information Through Directory Listing ベース
CWE-552: Files or Directories Accessible to External Parties ベース

CWE ビュー情報

脆弱性マッピングノート

理由 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
コメント : Use this View or other Views to search and navigate for the appropriate weakness.

ノート

CWE relationships for this view were obtained by examining the OWASP document and mapping to any items that were specifically mentioned within the text of a category. As a result, this mapping is not complete with respect to all of CWE. In addition, some concepts were mentioned in multiple Top Ten items, which caused them to be mapped to multiple CWE categories. For example, SQL injection is mentioned in both A1 (CWE-722) and A6 (CWE-727) categories.
As of 2008, some parts of CWE were not fully clarified out in terms of weaknesses. When these areas were mentioned in the OWASP Top Ten, category entries were mapped, although general mapping practice would usually favor mapping only to weaknesses.

対象者

ステークホルダー 説明
Software Developers This view outlines the most important issues as identified by the OWASP Top Ten (2004 version), providing a good starting point for web application developers who want to code more securely, as well as complying with PCI DSS 1.1.
Product Customers This view outlines the most important issues as identified by the OWASP Top Ten, providing customers with a way of asking their software developers to follow minimum expectations for secure code, in compliance with PCI-DSS 1.1.
Educators Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students. However, the 2007 version (CWE-629) might be more appropriate.

登録情報

名前 組織 日付 リリース日 Version
Veracode 2008-08-15 +00:00 2008-09-09 +00:00 1.0

変更履歴

名前 組織 日付 コメント
CWE Content Team MITRE 2017-11-08 +00:00 updated References
CWE Content Team MITRE 2019-01-03 +00:00 updated Description
CWE Content Team MITRE 2020-02-24 +00:00 updated View_Audience
CWE Content Team MITRE 2021-03-15 +00:00 updated Description, Maintenance_Notes, Relationship_Notes
CWE Content Team MITRE 2023-04-27 +00:00 updated References
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

参考文献

REF-570

Top 10 2004
http://www.owasp.org/index.php/Top_10_2004

REF-571

About the PCI Data Security Standard (PCI DSS)
PCI Security Standards Council.
https://listings.pcisecuritystandards.org/pci_security/

CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。