OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration

Opis

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top Ten 2021.

Wpisy w tej grupie

• CWE-2 7PK - Environment
• CWE-11 ASP.NET Misconfiguration: Creating Debug Binary
• CWE-13 ASP.NET Misconfiguration: Password in Configuration File
• CWE-15 External Control of System or Configuration Setting
• CWE-16 Configuration
• CWE-260 Password in Configuration File
• CWE-315 Cleartext Storage of Sensitive Information in a Cookie
• CWE-520 .NET Misconfiguration: Use of Impersonation
• CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable
• CWE-537 Java Runtime Error Message Containing Sensitive Information
• CWE-541 Inclusion of Sensitive Information in an Include File
• CWE-547 Use of Hard-coded, Security-relevant Constants
• CWE-611 Improper Restriction of XML External Entity Reference
• CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
• CWE-756 Missing Custom Error Page
• CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
• CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
• CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
• CWE-1032 OWASP Top Ten 2017 Category A6 - Security Misconfiguration
• CWE-1174 ASP.NET Misconfiguration: Improper Model Validation

Uwagi

As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories, which are discouraged for mapping. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła