CWE-1344 뷰 상세 정보

CWE-1344

Weaknesses in OWASP Top Ten (2021)
2021-10-05 +00:00
Incomplete
Graph
2023-06-29 +00:00
CWE Mitre.org
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
알림 관리

이름: Weaknesses in OWASP Top Ten (2021)

CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021.

CWE 구성원

CWE-1345: Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 기본
CWE-23: Relative Path Traversal 기본
CWE-35: Path Traversal: '.../...//' 기본
CWE-59: Improper Link Resolution Before File Access 기본
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor 기본
CWE-201: Insertion of Sensitive Information Into Sent Data 기본
CWE-219: Storage of File with Sensitive Data Under Web Root 기본
CWE-264: Permissions, Privileges, and Access Controls 카테고리
CWE-275: Permission Issues 카테고리
CWE-276: Incorrect Default Permissions 기본
CWE-284: Improper Access Control 기본
CWE-285: Improper Authorization 기본
CWE-352: Cross-Site Request Forgery 기본
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 기본
CWE-377: DEPRECATED: Insecure Temporary File 기본
CWE-402: Transmission of Private Resources into a New Sphere 기본
CWE-425: Direct Request 기본
CWE-441: Unintended Proxy or Intermediary 기본
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere 기본
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 기본
CWE-540: Inclusion of Sensitive Information in Source Code 기본
CWE-548: Exposure of Information Through Directory Listing 기본
CWE-552: Files or Directories Accessible to External Parties 기본
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 기본
CWE-601: URL Redirection to Untrusted Site 기본
CWE-639: Authorization Bypass Through User-Controlled Key 기본
CWE-651: Exposure of WSDL File Containing Sensitive Information 기본
CWE-668: Exposure of Resource to Wrong Sphere 기본
CWE-706: Use of Incorrectly-Resolved Name or Reference 기본
CWE-862: Missing Authorization 기본
CWE-863: Incorrect Authorization 기본
CWE-913: Improper Control of Dynamically-Managed Code Resources 기본
CWE-922: Insecure Storage of Sensitive Information 기본
CWE-1275: Sensitive Cookie with Improper SameSite Attribute 기본
CWE-1346: Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top Ten 2021.
CWE-261: Weak Encoding for Password 기본
CWE-296: Improper Following of a Certificate's Chain of Trust 기본
CWE-310: Cryptographic Issues 카테고리
CWE-319: Cleartext Transmission of Sensitive Information 기본
CWE-321: Use of Hard-coded Cryptographic Key 기본
CWE-322: Key Exchange without Entity Authentication 기본
CWE-323: Reusing a Nonce, Key Pair in Encryption 기본
CWE-324: Use of a Key Past its Expiration Date 기본
CWE-325: Missing Cryptographic Step 기본
CWE-326: Inadequate Encryption Strength 기본
CWE-327: Use of a Broken or Risky Cryptographic Algorithm 기본
CWE-328: Use of Weak Hash 기본
CWE-329: Generation of Predictable IV with CBC Mode 기본
CWE-330: Use of Insufficiently Random Values 기본
CWE-331: Insufficient Entropy 기본
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 기본
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 기본
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 기본
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 기본
CWE-340: Generation of Predictable Numbers or Identifiers 기본
CWE-347: Improper Verification of Cryptographic Signature 기본
CWE-523: Unprotected Transport of Credentials 기본
CWE-720: OWASP Top Ten 2007 Category A9 - Insecure Communications 카테고리
CWE-757: Selection of Less-Secure Algorithm During Negotiation 기본
CWE-759: Use of a One-Way Hash without a Salt 기본
CWE-760: Use of a One-Way Hash with a Predictable Salt 기본
CWE-780: Use of RSA Algorithm without OAEP 기본
CWE-818: OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection 카테고리
CWE-916: Use of Password Hash With Insufficient Computational Effort 기본
CWE-1347: Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top Ten 2021.
CWE-20: Improper Input Validation 기본
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 기본
CWE-75: Failure to Sanitize Special Elements into a Different Plane 기본
CWE-77: Improper Neutralization of Special Elements used in a Command 기본
CWE-78: Improper Neutralization of Special Elements used in an OS Command 기본
CWE-79: Improper Neutralization of Input During Web Page Generation 기본
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page 기본
CWE-83: Improper Neutralization of Script in Attributes in a Web Page 기본
CWE-87: Improper Neutralization of Alternate XSS Syntax 기본
CWE-88: Improper Neutralization of Argument Delimiters in a Command 기본
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 기본
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 기본
CWE-91: XML Injection 기본
CWE-93: Improper Neutralization of CRLF Sequences 기본
CWE-94: Improper Control of Generation of Code 기본
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 기본
CWE-96: Improper Neutralization of Directives in Statically Saved Code 기본
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 기본
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program 기본
CWE-99: Improper Control of Resource Identifiers 기본
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 기본
CWE-116: Improper Encoding or Escaping of Output 기본
CWE-138: Improper Neutralization of Special Elements 기본
CWE-184: Incomplete List of Disallowed Inputs 기본
CWE-470: Use of Externally-Controlled Input to Select Classes or Code 기본
CWE-471: Modification of Assumed-Immutable Data (MAID) 기본
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input 기본
CWE-610: Externally Controlled Reference to a Resource in Another Sphere 기본
CWE-643: Improper Neutralization of Data within XPath Expressions 기본
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax 기본
CWE-652: Improper Neutralization of Data within XQuery Expressions 기본
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement 기본
CWE-1348: Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top Ten 2021.
CWE-73: External Control of File Name or Path 기본
CWE-183: Permissive List of Allowed Inputs 기본
CWE-209: Generation of Error Message Containing Sensitive Information 기본
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies 기본
CWE-235: Improper Handling of Extra Parameters 기본
CWE-256: Plaintext Storage of a Password 기본
CWE-257: Storing Passwords in a Recoverable Format 기본
CWE-266: Incorrect Privilege Assignment 기본
CWE-269: Improper Privilege Management 기본
CWE-280: Improper Handling of Insufficient Permissions or Privileges 기본
CWE-311: Missing Encryption of Sensitive Data 기본
CWE-312: Cleartext Storage of Sensitive Information 기본
CWE-313: Cleartext Storage in a File or on Disk 기본
CWE-316: Cleartext Storage of Sensitive Information in Memory 기본
CWE-419: Unprotected Primary Channel 기본
CWE-430: Deployment of Wrong Handler 기본
CWE-434: Unrestricted Upload of File with Dangerous Type 기본
CWE-444: Inconsistent Interpretation of HTTP Requests 기본
CWE-451: User Interface (UI) Misrepresentation of Critical Information 기본
CWE-472: External Control of Assumed-Immutable Web Parameter 기본
CWE-501: Trust Boundary Violation 기본
CWE-522: Insufficiently Protected Credentials 기본
CWE-525: Use of Web Browser Cache Containing Sensitive Information 기본
CWE-539: Use of Persistent Cookies Containing Sensitive Information 기본
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session 기본
CWE-598: Use of HTTP Request With Sensitive Query String 기본
CWE-602: Client-Side Enforcement of Server-Side Security 기본
CWE-642: External Control of Critical State Data 기본
CWE-646: Reliance on File Name or Extension of Externally-Supplied File 기본
CWE-650: Trusting HTTP Permission Methods on the Server Side 기본
CWE-653: Improper Isolation or Compartmentalization 기본
CWE-656: Reliance on Security Through Obscurity 기본
CWE-657: Violation of Secure Design Principles 기본
CWE-799: Improper Control of Interaction Frequency 기본
CWE-807: Reliance on Untrusted Inputs in a Security Decision 기본
CWE-840: Business Logic Errors 카테고리
CWE-841: Improper Enforcement of Behavioral Workflow 기본
CWE-927: Use of Implicit Intent for Sensitive Communication 기본
CWE-1021: Improper Restriction of Rendered UI Layers or Frames 기본
CWE-1173: Improper Use of Validation Framework 기본

CWE 뷰 정보

취약점 매핑 메모

근거 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
댓글 : Use this View or other Views to search and navigate for the appropriate weakness.

메모

As of CWE 4.6, the relationships in this view were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

대상

이해관계자 설명
Software Developers This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing a good starting point for web application developers who want to code more securely.
Product Customers This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
Educators Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

제출

이름 조직 날짜 출시일 Version
CWE Content Team MITRE 2021-10-05 +00:00 2021-10-28 +00:00 4.6

수정 사항

이름 조직 날짜 댓글
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

참고 자료

REF-1206

OWASP Top 10:2021
https://owasp.org/Top10/

CVE Find에 제시된 정보는 엄선된 여러 참고 소스에서 가져옵니다. CVE 데이터는 MITRE Corporation과 국가 취약점 데이터베이스(NVD)에서 제공됩니다. KEV 카탈로그는 CISA에서 가져오며, EPSS 점수는 FIRST.org에서 제공됩니다. CWE 및 CAPEC 데이터는 MITRE Corporation에서 관리하며, CPE 정보는 NVD에서 제공됩니다.