繁體中文

CWE-731 類別詳細資料

CWE-731

OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
2008-09-09 +00:00
Obsolete
2025-09-09 +00:00
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: OWASP Top Ten 2004 Category A10 - Insecure Configuration Management

Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2004.

CWE 成員列表

CWE-209: Generation of Error Message Containing Sensitive Information 基礎

CWE-215: Insertion of Sensitive Information Into Debugging Code 基礎

CWE-219: Storage of File with Sensitive Data Under Web Root 基礎

CWE-295: Improper Certificate Validation 基礎

CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption 基礎

CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File 基礎

CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length 基礎

CWE-7: J2EE Misconfiguration: Missing Custom Error Page 基礎

CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote 基礎

CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods 基礎

CWE-459: Incomplete Cleanup 基礎

CWE-489: Active Debug Code 基礎

CWE-11: ASP.NET Misconfiguration: Creating Debug Binary 基礎

CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page 基礎

CWE-13: ASP.NET Misconfiguration: Password in Configuration File 基礎

CWE-520: .NET Misconfiguration: Use of Impersonation 基礎

CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework 基礎

CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation 基礎

CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable 基礎

CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere 基礎

CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere 基礎

CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere 基礎

CWE-530: Exposure of Backup File to an Unauthorized Control Sphere 基礎

CWE-531: Inclusion of Sensitive Information in Test Code 基礎

CWE-532: Insertion of Sensitive Information into Log File 基礎

CWE-540: Inclusion of Sensitive Information in Source Code 基礎

CWE-541: Inclusion of Sensitive Information in an Include File 基礎

CWE-548: Exposure of Information Through Directory Listing 基礎

CWE-552: Files or Directories Accessible to External Parties 基礎

CWE 資訊

漏洞對應備注

理由說明 : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
備註 : See member weaknesses of this category.

提交

名稱 機構 日期 發布日期 Version
Veracode 2008-08-15 +00:00 2008-09-09 +00:00 1.0

修改記錄

名稱 機構 日期 備註
CWE Content Team MITRE 2009-03-10 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Relationships
CWE Content Team MITRE 2018-03-27 +00:00 updated Relationships
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-09-09 +00:00 updated References

參考資料

REF-591

A10 Insecure Configuration Management
OWASP.
https://github.com/OWASP/Top10/blob/master/2004/OWASP_Top_Ten_2004.pdf

cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。