MITRE Releases Top 25 Most Dangerous Software Weaknesses

The top 25 most dangerous software weaknesses impacting software for the previous two calendar years have been published by MITRE as part of the 2023 Common Weaknesses Enumeration (CWE).

Attackers can utilize these flaws to seize control of a vulnerable system, steal data, or disrupt the functioning of certain programs. Because of these flaws, software becomes seriously vulnerable.

“These weaknesses lead to serious vulnerabilities in software. An attacker can often exploit these vulnerabilities to take control of an affected system, steal data, or prevent applications from working,” CISA advised.

Software defects cover a wide variety of problems, such as holes, bugs, weaknesses, and mistakes in the architecture, implementation, code, or design of software solutions.

With a focus on the CVE records added to CISA’s Known Exploited Vulnerabilities (KEV) database, MITRE evaluated 43,996 CVE entries from NIST’s National Vulnerability Database (NVD) for vulnerabilities discovered and reported across 2021 and 2022 to compile this list.

Each weakness was then given a score based on its severity and prevalence.

Following the gathering, scoping, and remapping stages, a scoring formula was used to determine the weaknesses in order of severity. 

This formula takes into account both the frequency (the frequency with which a CWE is the primary cause of a vulnerability) and the average severity of each vulnerability when it is exploited (as determined by the CVSS score), according to MITRE.

Both frequency and severity are normalized concerning the maximum and minimum values recorded in the data set.

Top 25 Software Weaknesses

Rank	ID	Name	Score	CVEs in KEV	Rank Change
1	CWE-787	Out-of-bounds Write	63.72	70	0
2	CWE-79	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	45.54	4	0
3	CWE-89	Improper Neutralization of Special Elements Used in an SQL Command (‘SQL Injection’)	34.27	6	0
4	CWE-416	Use After Free	16.71	44	+3
5	CWE-78	Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)	15.65	23	+1
6	CWE-20	Improper Input Validation	15.50	35	-2
7	CWE-125	Out-of-bounds Read	14.60	2	-2
8	CWE-22	Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	14.11	16	0
9	CWE-352	Cross-Site Request Forgery (CSRF)	11.73	0	0
10	CWE-434	Unrestricted Upload of File with Dangerous Type	10.41	5	0
11	CWE-862	Missing Authorization	6.90	0	+5
12	CWE-476	NULL Pointer Dereference	6.59	0	-1
13	CWE-287	Improper Authentication	6.39	10	+1
14	CWE-190	Integer Overflow or Wraparound	5.89	4	-1
15	CWE-502	Deserialization of Untrusted Data	5.56	14	-3
16	CWE-77	Improper Neutralization of Special Elements Used in a Command (‘Command Injection’)	4.95	4	+1
17	CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	4.75	7	+2
18	CWE-798	Use of Hard-coded Credentials	4.57	2	-3
19	CWE-918	Server-Side Request Forgery (SSRF)	4.56	16	+2
20	CWE-306	Missing Authentication for Critical Function	3.78	8	-2
21	CWE-362	Concurrent Execution using Shared Resources with Improper Synchronization (‘Race Condition’)	3.53	8	+1
22	CWE-269	Improper Privilege Management	3.31	5	+7
23	CWE-94	Improper Control of Generation of Code (‘Code Injection’)	3.30	6	+2
24	CWE-863	Incorrect Authorization	3.16	0	+4
25	CWE-276	Incorrect Default Permissions	3.16	0	-5

The list highlights the most prevalent and significant software flaws at the moment. These can result in exploitable vulnerabilities that enable adversaries to take over a system entirely, steal data, or stop apps from running.

They are frequently simple to detect and exploit. Successful exploitation can provide attackers access to sensitive data, exfiltrate the data, or cause a denial-of-service (DoS) on the targeted computers.

CISA urges developers and product security response teams to analyze the CWE Top 25 and assess suggested mitigations to choose the ones that are most appropriate for adoption.

“CISA encourages developers and product security response teams to review the CWE Top 25 and evaluate recommended mitigations to determine those most suitable to adopt”, CISA said.

“Over the coming weeks, the CWE program will be publishing a series of further articles on the CWE Top 25 methodology, vulnerability mapping trends, and other useful information that help illustrate how vulnerability management plays an important role in Shifting the Balance of Cybersecurity Risk”.

Additionally, CISA, the FBI, the Australian Cyber Security Centre (ACSC), and the UK’s National Cyber Security Centre (NCSC) all released a list of often exploited issues for 2020.

A list of the top 10 most often exploited security issues from 2016 to 2019 has also been provided by CISA and the FBI.

The most hazardous programming, design, and architectural security issues that affect hardware systems are also listed by MITRE in a list.

“AI-based email security measures Protect your business From Email Threats!” – .