Configuration

Opis

Weaknesses in this category are typically introduced during the configuration of the software.

Uwagi

Further discussion about this category was held over the CWE Research mailing list in early 2020. No definitive action has been decided.

This entry is a Category, but various sources map to it anyway, despite CWE guidance that Categories should not be mapped. In this case, there are no clear CWE Weaknesses that can be utilized. "Inappropriate Configuration" sounds more like a Weakness in CWE's style, but it still does not indicate actual behavior of the product. Further research is still required, however, as a "configuration weakness" might be Primary to many other CWEs, i.e., it might be better described in terms of chaining relationships.

Źródła