CWE-1000 视图详情

This view has a hierarchical organization of all weaknesses within CWE. It is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors and other dimensions instead of how the weaknesses can be detected or mitigated, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

备注

This view uses a deep hierarchical organization, with more levels of abstraction than other classification schemes. The top-level entries are called Pillars. Where possible, this view uses abstractions that do not consider particular languages, frameworks, technologies, life cycle development phases, frequency of occurrence, or types of resources. It explicitly identifies relationships that form chains and composites, which had not been a formal part of past classification efforts. Chains and composites might help explain why mutual exclusivity is difficult to achieve within security error taxonomies. This view is roughly aligned with CWE's original research into vulnerability theory, especially with respect to behaviors and resources. Ideally, this view will only cover weakness-to-weakness relationships, with minimal overlap and zero groupings. It is expected to include at least one parent/child relationship for every active (non-deprecated) weakness within CWE.

目标受众

提交记录

修改记录