The top 25 most dangerous software weaknesses impacting software for the previous two calendar years have been published by MITRE as part of the 2023 Common Weaknesses Enumeration (CWE).
Attackers can utilize these flaws to seize control of a vulnerable system, steal data, or disrupt the functioning of certain programs. Because of these flaws, software becomes seriously vulnerable.
“These weaknesses lead to serious vulnerabilities in software. An attacker can often exploit these vulnerabilities to take control of an affected system, steal data, or prevent applications from working,” CISA advised.
Software defects cover a wide variety of problems, such as holes, bugs, weaknesses, and mistakes in the architecture, implementation, code, or design of software solutions.
With a focus on the CVE records added to CISA’s Known Exploited Vulnerabilities (KEV) database, MITRE evaluated 43,996 CVE entries from NIST’s National Vulnerability Database (NVD) for vulnerabilities discovered and reported across 2021 and 2022 to compile this list.
Each weakness was then given a score based on its severity and prevalence.
Following the gathering, scoping, and remapping stages, a scoring formula was used to determine the weaknesses in order of severity.
This formula takes into account both the frequency (the frequency with which a CWE is the primary cause of a vulnerability) and the average severity of each vulnerability when it is exploited (as determined by the CVSS score), according to MITRE.
Both frequency and severity are normalized concerning the maximum and minimum values recorded in the data set.
Top 25 Software Weaknesses
| Rank | ID | Name | Score | CVEs in KEV | Rank Change |
|---|---|---|---|---|---|
| 1 | CWE-787 | Out-of-bounds Write | 63.72 | 70 | 0 |
| 2 | CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 45.54 | 4 | 0 |
| 3 | CWE-89 | Improper Neutralization of Special Elements Used in an SQL Command (‘SQL Injection’) | 34.27 | 6 | 0 |
| 4 | CWE-416 | Use After Free | 16.71 | 44 | +3 |
| 5 | CWE-78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | 15.65 | 23 | +1 |
| 6 | CWE-20 | Improper Input Validation | 15.50 | 35 | -2 |
| 7 | CWE-125 | Out-of-bounds Read | 14.60 | 2 | -2 |
| 8 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 14.11 | 16 | 0 |
| 9 | CWE-352 | Cross-Site Request Forgery (CSRF) | 11.73 | 0 | 0 |
| 10 | CWE-434 | Unrestricted Upload of File with Dangerous Type | 10.41 | 5 | 0 |
| 11 | CWE-862 | Missing Authorization | 6.90 | 0 | +5 |
| 12 | CWE-476 | NULL Pointer Dereference | 6.59 | 0 | -1 |
| 13 | CWE-287 | Improper Authentication | 6.39 | 10 | +1 |
| 14 | CWE-190 | Integer Overflow or Wraparound | 5.89 | 4 | -1 |
| 15 | CWE-502 | Deserialization of Untrusted Data | 5.56 | 14 | -3 |
| 16 | CWE-77 | Improper Neutralization of Special Elements Used in a Command (‘Command Injection’) | 4.95 | 4 | +1 |
| 17 | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 4.75 | 7 | +2 |
| 18 | CWE-798 | Use of Hard-coded Credentials | 4.57 | 2 | -3 |
| 19 | CWE-918 | Server-Side Request Forgery (SSRF) | 4.56 | 16 | +2 |
| 20 | CWE-306 | Missing Authentication for Critical Function | 3.78 | 8 | -2 |
| 21 | CWE-362 | Concurrent Execution using Shared Resources with Improper Synchronization (‘Race Condition’) | 3.53 | 8 | +1 |
| 22 | CWE-269 | Improper Privilege Management | 3.31 | 5 | +7 |
| 23 | CWE-94 | Improper Control of Generation of Code (‘Code Injection’) | 3.30 | 6 | +2 |
| 24 | CWE-863 | Incorrect Authorization | 3.16 | 0 | +4 |
| 25 | CWE-276 | Incorrect Default Permissions | 3.16 | 0 | -5 |
The list highlights the most prevalent and significant software flaws at the moment. These can result in exploitable vulnerabilities that enable adversaries to take over a system entirely, steal data, or stop apps from running.
They are frequently simple to detect and exploit. Successful exploitation can provide attackers access to sensitive data, exfiltrate the data, or cause a denial-of-service (DoS) on the targeted computers.
CISA urges developers and product security response teams to analyze the CWE Top 25 and assess suggested mitigations to choose the ones that are most appropriate for adoption.
“CISA encourages developers and product security response teams to review the CWE Top 25 and evaluate recommended mitigations to determine those most suitable to adopt”, CISA said.
“Over the coming weeks, the CWE program will be publishing a series of further articles on the CWE Top 25 methodology, vulnerability mapping trends, and other useful information that help illustrate how vulnerability management plays an important role in Shifting the Balance of Cybersecurity Risk”.
Additionally, CISA, the FBI, the Australian Cyber Security Centre (ACSC), and the UK’s National Cyber Security Centre (NCSC) all released a list of often exploited issues for 2020.
A list of the top 10 most often exploited security issues from 2016 to 2019 has also been provided by CISA and the FBI.
The most hazardous programming, design, and architectural security issues that affect hardware systems are also listed by MITRE in a list.
“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.
