OWASP Top Ten 2025 Category A02:2025 - Security Misconfiguration

Opis

Weaknesses in this category are related to the A02 category "Security Misconfiguration" in the OWASP Top Ten 2025.

Wpisy w tej grupie

• CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
• CWE-11 ASP.NET Misconfiguration: Creating Debug Binary
• CWE-1174 ASP.NET Misconfiguration: Improper Model Validation
• CWE-13 ASP.NET Misconfiguration: Password in Configuration File
• CWE-15 External Control of System or Configuration Setting
• CWE-16 Configuration
• CWE-260 Password in Configuration File
• CWE-315 Cleartext Storage of Sensitive Information in a Cookie
• CWE-489 Active Debug Code
• CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption
• CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable
• CWE-547 Use of Hard-coded, Security-relevant Constants
• CWE-611 Improper Restriction of XML External Entity Reference
• CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
• CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
• CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains

Uwagi

As of CWE 4.19, the relationships in this category were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła