CWE Top 25 – Mitre Released Top 25 Most Dangerous Software Bugs

Recently, Mitre released the top 25 most dangerous software bugs 2020; this list is a definitive list of the most popular and impactful issues that are encountered in CWE Top 25 (2019).

The security experts asserted that these software bugs are dangerous, as they are usually easy to find and exploit. Moreover, it enables attackers to hijack a system completely, steals data, or stop an application from working.

The CWE top 25 is a worthwhile association resource that will help the developers, researchers, as well as the users to secure their businesses. Moreover, CWE provides penetration into the most severe and modern security vulnerabilities.

25 Most Dangerous Software Bugs

Rank	ID	Name	Score
[1]	CWE-79	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	46.82
[2]	CWE-787	Out-of-bounds Write	46.17
[3]	CWE-20	Improper Input Validation	33.47
[4]	CWE-125	Out-of-bounds Read	26.50
[5]	CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	23.73
[6]	CWE-89	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	20.69
[7]	CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	19.16
[8]	CWE-416	Use After Free	18.87
[9]	CWE-352	Cross-Site Request Forgery (CSRF)	17.29
[10]	CWE-78	Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)	16.44
[11]	CWE-190	Integer Overflow or Wraparound	15.81
[12]	CWE-22	Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	13.67
[13]	CWE-476	NULL Pointer Dereference	8.35
[14]	CWE-287	Improper Authentication	8.17
[15]	CWE-434	Unrestricted Upload of File with Dangerous Type	7.38
[16]	CWE-732	Incorrect Permission Assignment for Critical Resource	6.95
[17]	CWE-94	Improper Control of Generation of Code (‘Code Injection’)	6.53
[18]	CWE-522	Insufficiently Protected Credentials	5.49
[19]	CWE-611	Improper Restriction of XML External Entity Reference	5.33
[20]	CWE-798	Use of Hard-coded Credentials	5.19
[21]	CWE-502	Deserialization of Untrusted Data	4.93
[22]	CWE-269	Improper Privilege Management	4.87
[23]	CWE-400	Uncontrolled Resource Consumption	4.14
[24]	CWE-306	Missing Authentication for Critical Function	3.85
[25]	CWE-862	Missing Authorization	3.77

Analysis Report

This year’s Top 25 CWE list has increased the transition to more distinct weaknesses as they are fought to complex class-level vulnerabilities. These class-level weaknesses yet endure in the list, but these weaknesses have moved down in the ranking. 

The security researchers affirmed that this movement would be continuing, as every year, more advanced and dangerous weaknesses will be introduced. 

If we look correctly to list, then we can recognize that the class-level weaknesses like the CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), the CWE-20 (Improper Input Validation), and the CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) all have moved down a few of places. 

On the other side, there are more specific weaknesses like the CWE-79 (Improper Neutralization of Input During Web Page Generation), and the CWE-787 (Out-of-bounds Write), and CWE-125 (Out-of-bounds Read) were moved towards up to take their spots.

Rather than this weakness, there is another specific movement that is again the result of the mapping, the CWE-772 (Missing Release of Resource after Effective Lifetime) was at the number 21 in the list. And as we said that this movement would be continuing, as every year, new specific weaknesses will be introduced.

Flaws related to Authentication and Authorization

The most significant progress of the list comprises four major weaknesses that are associated with the Authentication and Authorization, and here they are mentioned below:-

• The CWE-522 (Insufficiently Protected Credentials): from 27 to 18
• The CWE-306 (Missing Authentication for Critical Function): from 36 to 24
• The CWE-862 (Missing Authorization): from 34 to 25
• CWE-863 (Incorrect Authorization): from 33 to 29

Methodology

This new list is quite specific, as it was developed by getting all issued vulnerability data from the NVD. The NVD gets these vulnerability data from CVE and then extends these vulnerabilities along with the additional analysis and information.

This information includes a mapping to one or more weaknesses, and at the same time, the CVSS score, which is a numerical score outlining the possible severity of all these vulnerabilities that are generally based upon a regulated set of features regarding the vulnerability.

Moreover, this year’s list is more leverage as compared to the list of 2018 and 2019. However, to ascertain a CWE’s frequency, the scoring formula determines the number of occasions a CWE is mapped to a CVE with the NVD.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.