OWASP Top Ten 2025 Category A04:2025 - Cryptographic Failures

Opis

Weaknesses in this category are related to the A04 category "Cryptographic Failures" in the OWASP Top Ten 2025.

Wpisy w tej grupie

• CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation
• CWE-1241 Use of Predictable Algorithm in Random Number Generator
• CWE-261 Weak Encoding for Password
• CWE-296 Improper Following of a Certificate's Chain of Trust
• CWE-319 Cleartext Transmission of Sensitive Information
• CWE-320 Key Management Errors
• CWE-321 Use of Hard-coded Cryptographic Key
• CWE-322 Key Exchange without Entity Authentication
• CWE-323 Reusing a Nonce, Key Pair in Encryption
• CWE-324 Use of a Key Past its Expiration Date
• CWE-325 Missing Cryptographic Step
• CWE-326 Inadequate Encryption Strength
• CWE-327 Use of a Broken or Risky Cryptographic Algorithm
• CWE-328 Use of Weak Hash
• CWE-329 Generation of Predictable IV with CBC Mode
• CWE-330 Use of Insufficiently Random Values
• CWE-331 Insufficient Entropy
• CWE-332 Insufficient Entropy in PRNG
• CWE-334 Small Space of Random Values
• CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
• CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG)
• CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)
• CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• CWE-340 Generation of Predictable Numbers or Identifiers
• CWE-342 Predictable Exact Value from Previous Values
• CWE-347 Improper Verification of Cryptographic Signature
• CWE-523 Unprotected Transport of Credentials
• CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
• CWE-759 Use of a One-Way Hash without a Salt
• CWE-760 Use of a One-Way Hash with a Predictable Salt
• CWE-780 Use of RSA Algorithm without OAEP
• CWE-916 Use of Password Hash With Insufficient Computational Effort

Uwagi

As of CWE 4.19, the relationships in this category were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła