Recently, Mitre released the top 25 most dangerous software bugs 2020; this list is a definitive list of the most popular and impactful issues that are encountered in CWE Top 25 (2019).
The security experts asserted that these software bugs are dangerous, as they are usually easy to find and exploit. Moreover, it enables attackers to hijack a system completely, steals data, or stop an application from working.
The CWE top 25 is a worthwhile association resource that will help the developers, researchers, as well as the users to secure their businesses. Moreover, CWE provides penetration into the most severe and modern security vulnerabilities.
25 Most Dangerous Software Bugs
| Rank | ID | Name | Score |
|---|---|---|---|
| [1] | CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 46.82 |
| [2] | CWE-787 | Out-of-bounds Write | 46.17 |
| [3] | CWE-20 | Improper Input Validation | 33.47 |
| [4] | CWE-125 | Out-of-bounds Read | 26.50 |
| [5] | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 23.73 |
| [6] | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 20.69 |
| [7] | CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 19.16 |
| [8] | CWE-416 | Use After Free | 18.87 |
| [9] | CWE-352 | Cross-Site Request Forgery (CSRF) | 17.29 |
| [10] | CWE-78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | 16.44 |
| [11] | CWE-190 | Integer Overflow or Wraparound | 15.81 |
| [12] | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 13.67 |
| [13] | CWE-476 | NULL Pointer Dereference | 8.35 |
| [14] | CWE-287 | Improper Authentication | 8.17 |
| [15] | CWE-434 | Unrestricted Upload of File with Dangerous Type | 7.38 |
| [16] | CWE-732 | Incorrect Permission Assignment for Critical Resource | 6.95 |
| [17] | CWE-94 | Improper Control of Generation of Code (‘Code Injection’) | 6.53 |
| [18] | CWE-522 | Insufficiently Protected Credentials | 5.49 |
| [19] | CWE-611 | Improper Restriction of XML External Entity Reference | 5.33 |
| [20] | CWE-798 | Use of Hard-coded Credentials | 5.19 |
| [21] | CWE-502 | Deserialization of Untrusted Data | 4.93 |
| [22] | CWE-269 | Improper Privilege Management | 4.87 |
| [23] | CWE-400 | Uncontrolled Resource Consumption | 4.14 |
| [24] | CWE-306 | Missing Authentication for Critical Function | 3.85 |
| [25] | CWE-862 | Missing Authorization | 3.77 |
Analysis Report
This year’s Top 25 CWE list has increased the transition to more distinct weaknesses as they are fought to complex class-level vulnerabilities. These class-level weaknesses yet endure in the list, but these weaknesses have moved down in the ranking.
The security researchers affirmed that this movement would be continuing, as every year, more advanced and dangerous weaknesses will be introduced.
If we look correctly to list, then we can recognize that the class-level weaknesses like the CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), the CWE-20 (Improper Input Validation), and the CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) all have moved down a few of places.
On the other side, there are more specific weaknesses like the CWE-79 (Improper Neutralization of Input During Web Page Generation), and the CWE-787 (Out-of-bounds Write), and CWE-125 (Out-of-bounds Read) were moved towards up to take their spots.
Rather than this weakness, there is another specific movement that is again the result of the mapping, the CWE-772 (Missing Release of Resource after Effective Lifetime) was at the number 21 in the list. And as we said that this movement would be continuing, as every year, new specific weaknesses will be introduced.
Flaws related to Authentication and Authorization
The most significant progress of the list comprises four major weaknesses that are associated with the Authentication and Authorization, and here they are mentioned below:-
- The CWE-522 (Insufficiently Protected Credentials): from 27 to 18
- The CWE-306 (Missing Authentication for Critical Function): from 36 to 24
- The CWE-862 (Missing Authorization): from 34 to 25
- CWE-863 (Incorrect Authorization): from 33 to 29
Methodology
This new list is quite specific, as it was developed by getting all issued vulnerability data from the NVD. The NVD gets these vulnerability data from CVE and then extends these vulnerabilities along with the additional analysis and information.
This information includes a mapping to one or more weaknesses, and at the same time, the CVSS score, which is a numerical score outlining the possible severity of all these vulnerabilities that are generally based upon a regulated set of features regarding the vulnerability.
Moreover, this year’s list is more leverage as compared to the list of 2018 and 2019. However, to ascertain a CWE’s frequency, the scoring formula determines the number of occasions a CWE is mapped to a CVE with the NVD.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
){kind=link}