A CVE tells you that one product has one flaw. A CWE tells you what kind of mistake produced it — and that is the more useful piece of information, because a team that keeps shipping the same class of weakness will keep generating CVEs. Reading findings by weakness class rather than by individual identifier is what turns a remediation queue into a change in how software is written.
What is CWE?
CWE (Common Weakness Enumeration) is a community-maintained catalog of common software and hardware security weaknesses. Unlike CVE, which describes specific vulnerabilities, CWE defines categories of flaws that can lead to vulnerabilities.
| Aspect | CWE | CVE |
|---|---|---|
| What it describes | Type of weakness/flaw | Specific vulnerability |
| Example | CWE-79: Cross-site Scripting | CVE-2021-44228: Log4Shell |
| Number of entries | ~1000 types | ~250,000+ vulnerabilities |
| Variability | Stable (categories) | Grows daily |
| Use case | Education, code analysis | Patching, alerting |
Simple analogy:
- CWE = type of disease (flu)
- CVE = specific case of illness (patient #12345 with flu)
Who Maintains CWE?
CWE is developed by MITRE Corporation in collaboration with the security community. The list is funded by CISA (Cybersecurity and Infrastructure Security Agency).
- Homepage: https://cwe.mitre.org
- Version: CWE 4.14 (February 2024)
- Entries: ~950 weakness types
CWE Structure
CWE Hierarchy
CWE is organized hierarchically:
CWE-1000: Research Concepts (root)
└── CWE-699: Software Development (category)
└── CWE-20: Improper Input Validation (class)
└── CWE-79: Cross-site Scripting (base)
└── CWE-80: Basic XSS (variant)CWE Entry Types
| Type | Description | Example |
|---|---|---|
| Pillar | Highest abstraction level | CWE-682: Incorrect Calculation |
| Class | Abstract weakness class | CWE-20: Improper Input Validation |
| Base | Specific weakness | CWE-79: XSS |
| Variant | Specific variant | CWE-80: Basic XSS |
| Compound | Combination of weaknesses | CWE-352: CSRF |
Anatomy of a CWE Entry
Each CWE entry contains:
CWE-89: Improper Neutralization of Special Elements
used in an SQL Command ('SQL Injection')
├── Description (weakness description)
├── Extended Description (technical details)
├── Relationships (relationships with other CWEs)
├── Applicable Platforms (languages, technologies)
├── Common Consequences (exploitation effects)
├── Likelihood of Exploit (probability)
├── Detection Methods (how to detect)
├── Potential Mitigations (how to prevent)
├── Demonstrative Examples (code examples)
├── Observed Examples (related CVEs)
└── References (sources)CWE Top 25 Most Dangerous Software Weaknesses
MITRE annually publishes a list of 25 most dangerous weaknesses based on real vulnerability data (CVE) and their impact.
CWE Top 25 (2024)
| Rank | CWE ID | Name | Example |
|---|---|---|---|
| 1 | CWE-79 | Cross-site Scripting (XSS) | JS injection into page |
| 2 | CWE-89 | SQL Injection | ' OR '1'='1 |
| 3 | CWE-416 | Use After Free | Access to freed memory |
| 4 | CWE-78 | OS Command Injection | ; rm -rf / |
| 5 | CWE-20 | Improper Input Validation | Lack of input validation |
| 6 | CWE-125 | Out-of-bounds Read | Reading beyond buffer |
| 7 | CWE-22 | Path Traversal | ../../../etc/passwd |
| 8 | CWE-352 | Cross-Site Request Forgery | Unauthorized action |
| 9 | CWE-787 | Out-of-bounds Write | Buffer overflow |
| 10 | CWE-287 | Improper Authentication | Weak authentication |
Full Top 25 List (2024)
| Rank | CWE ID | Name |
|---|---|---|
| 11 | CWE-476 | NULL Pointer Dereference |
| 12 | CWE-798 | Use of Hard-coded Credentials |
| 13 | CWE-190 | Integer Overflow |
| 14 | CWE-502 | Deserialization of Untrusted Data |
| 15 | CWE-77 | Command Injection |
| 16 | CWE-119 | Buffer Overflow |
| 17 | CWE-862 | Missing Authorization |
| 18 | CWE-276 | Incorrect Default Permissions |
| 19 | CWE-918 | Server-Side Request Forgery (SSRF) |
| 20 | CWE-306 | Missing Authentication |
| 21 | CWE-362 | Race Condition |
| 22 | CWE-269 | Improper Privilege Management |
| 23 | CWE-94 | Code Injection |
| 24 | CWE-863 | Incorrect Authorization |
| 25 | CWE-400 | Uncontrolled Resource Consumption |
Key CWEs - Details
CWE-79: Cross-site Scripting (XSS)
Description: Application does not neutralize or improperly neutralizes user input before including it in HTML output.
XSS Types:
- Reflected (CWE-79) - payload in URL, executed immediately
- Stored (CWE-79) - payload stored in database, executed on each view
- DOM-based (CWE-79) - payload manipulates DOM without server roundtrip
Vulnerable code example (PHP):
// BAD - no encoding
echo "Hello, " . $_GET['name'];
// Attack: ?name=<script>alert('XSS')</script>Correct solution:
// GOOD - HTML encoding
echo "Hello, " . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');Mitigations:
- Output encoding
- Content Security Policy (CSP)
- Input validation and sanitization
- Using frameworks with auto-escape (React, Angular)
CWE-89: SQL Injection
Description: Application constructs SQL queries using user input without proper neutralization.
Vulnerable code example (PHP):
// BAD - concatenation
$query = "SELECT * FROM users WHERE id = " . $_GET['id'];
// Attack: ?id=1 OR 1=1Correct solution:
// GOOD - prepared statements
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$_GET['id']]);Mitigations:
- Prepared statements / parameterized queries (most important!)
- ORM with parameterization
- Input type validation
- Least privilege principle for DB account
CWE-22: Path Traversal
Description: Application uses user input to construct file paths without proper validation.
Vulnerable code example (Python):
# BAD - no path validation
filename = request.args.get('file')
return send_file(f"/uploads/{filename}")
# Attack: ?file=../../../etc/passwdCorrect solution:
# GOOD - validation and normalization
import os
filename = request.args.get('file')
safe_path = os.path.normpath(os.path.join('/uploads', filename))
if not safe_path.startswith('/uploads/'):
abort(403)
return send_file(safe_path)CWE-798: Use of Hard-coded Credentials
Description: Application contains hard-coded passwords, API keys, or other secrets.
Vulnerable code example:
# BAD - password in code
DB_PASSWORD = "SuperSecretPassword123!"
API_KEY = "sk-1234567890abcdef"Correct solution:
# GOOD - environment variables or secrets manager
import os
DB_PASSWORD = os.environ.get('DB_PASSWORD')
API_KEY = os.environ.get('API_KEY')
# Or: AWS Secrets Manager, HashiCorp Vault, Azure Key VaultCWE vs OWASP Top 10
CWE and OWASP Top 10 are related but serve different purposes:
| Aspect | CWE | OWASP Top 10 |
|---|---|---|
| Scope | All weaknesses | Top 10 categories for web |
| Granularity | Detailed (950+ entries) | High abstraction (10 categories) |
| Updates | Continuous | Every ~4 years |
| Use case | Technical classification | Awareness, prioritization |
OWASP Top 10 (2021) to CWE Mapping
| OWASP | Main CWEs |
|---|---|
| A01: Broken Access Control | CWE-200, CWE-284, CWE-285, CWE-639 |
| A02: Cryptographic Failures | CWE-259, CWE-327, CWE-331 |
| A03: Injection | CWE-77, CWE-78, CWE-79, CWE-89 |
| A04: Insecure Design | CWE-209, CWE-256, CWE-501 |
| A05: Security Misconfiguration | CWE-16, CWE-611 |
| A06: Vulnerable Components | CWE-1104 |
| A07: Auth Failures | CWE-287, CWE-384, CWE-613 |
| A08: Software/Data Integrity | CWE-494, CWE-502, CWE-829 |
| A09: Logging Failures | CWE-117, CWE-223, CWE-532 |
| A10: SSRF | CWE-918 |
How to Use CWE in Practice?
1. Secure Code Review
During code review, look for patterns matching specific CWEs:
Code Review Checklist:
□ CWE-79: Is user data encoded before display?
□ CWE-89: Are we using prepared statements?
□ CWE-22: Are file paths validated?
□ CWE-798: Are there no hardcoded credentials?
□ CWE-502: Are we only deserializing trusted data?2. SAST/DAST Configuration
SAST tools (e.g., SonarQube, Checkmarx) report findings with CWE references:
Finding: SQL Injection vulnerability
File: UserController.java:45
CWE: CWE-89
Severity: Critical
Recommendation: Use PreparedStatement instead of string concatenation3. Vulnerability Classification
Assign CWE to discovered vulnerabilities:
Pentest Report:
┌────────────────────────────────────────────────┐
│ Finding #1: Stored XSS in comments │
│ CWE: CWE-79 │
│ CVSS: 6.1 (Medium) │
│ OWASP: A03:2021 Injection │
│ Remediation: Implement output encoding │
└────────────────────────────────────────────────┘4. Developer Training
Developer training based on CWE Top 25:
- Week 1: CWE-79 (XSS) - theory + exercises
- Week 2: CWE-89 (SQLi) - theory + exercises
- Week 3: CWE-22 (Path Traversal) - theory + exercises
- …
5. Procurement Requirements
In vendor requirements:
“Delivered software must not contain weaknesses from the CWE Top 25 Most Dangerous Software Weaknesses list, which will be verified through SAST/DAST scanning before acceptance.”
Tools Supporting CWE
| Tool | Type | CWE Support |
|---|---|---|
| SonarQube | SAST | Rule mapping to CWE |
| Checkmarx | SAST | Native CWE reporting |
| Snyk | SCA/SAST | CWE in reports |
| OWASP ZAP | DAST | CWE ID in alerts |
| Burp Suite | DAST | CWE references |
| Semgrep | SAST | Custom rules with CWE |
CWE in Regulations and Standards
| Regulation/Standard | CWE Requirements |
|---|---|
| PCI DSS 4.0 | Requires addressing OWASP Top 10 (mapped to CWE) |
| NIST SSDF | Recommends using CWE for classification |
| ISO 27001 | Indirectly through secure development |
| NIS2 | Secure software development requirements |
| Cyber Resilience Act | Will require CWE reporting |
FAQ
Does every vulnerability (CVE) have an assigned CWE?
Not always, but NVD tries to assign CWE to all CVEs. The vast majority of CVEs have assigned CWE.
How many CWEs should I know as a developer?
Start with CWE Top 25. This covers most real problems. Then learn CWEs specific to your technology (e.g., CWE-918 SSRF for cloud applications).
Does CWE only apply to web applications?
No. CWE covers weaknesses in:
- Web applications
- Desktop applications
- Embedded systems
- Hardware
- Cryptography
- Configuration
How to report new CWE?
You can submit proposals for new CWEs through the MITRE CWE website. Justification is required that the weakness is common and not covered by existing CWE.
Summary
- CWE is a catalog of software weakness types (not specific vulnerabilities)
- CVE describes specific vulnerabilities, CWE classifies the type of flaw
- CWE Top 25 is the list of most dangerous weaknesses - mandatory knowledge for developers
- Most important CWEs: CWE-79 (XSS), CWE-89 (SQLi), CWE-22 (Path Traversal)
- Use CWE for classification in reports, training, vendor requirements
- SAST/DAST tools automatically report findings with CWE references
Want to check your code security? Order source code audit or application penetration testing. Contact us.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Application Security — Application security encompasses a set of practices, tools, and processes aimed…
- Secure Coding — Secure coding is a set of practices, techniques, and tools used in the software…
- DAST (Dynamic Application Security Testing) — DAST (Dynamic Application Security Testing) is a method of application security…
- SAST (Static Application Security Testing) — SAST (Static Application Security Testing) is a method of application security…
- Desktop Application Security Testing — Desktop application security testing is the process of evaluating and verifying…
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
