Top 25 Most Dangerous Software Weaknesses

There are always security weaknesses in software, no matter how sound the software may appear to be.

You can fix one weakness, and suddenly you realize there are five more.

To make these weaknesses easier for security professionals to identify, the Cybersecurity and Infrastructure Security Agency (CISA) has released the Common Weakness Enumeration (CWE) top 25 most dangerous software weaknesses list. 

Top 25 software weaknesses

The data used to compile the list of the most dangerous software weaknesses comes from NIST's National Vulnerability Database (NVD), which tracks reported security vulnerabilities, weaknesses, and risks.

Here is how the list is described and why it can be of use: 

"The 2021 Common Weakness Enumeration (CWE™) Top 25 Most Dangerous Software Weaknesses (CWE Top 25) is a demonstrative list of the most common and impactful issues experienced over the previous two calendar years. These weaknesses are dangerous because they are often easy to find, exploit, and can allow adversaries to completely take over a system, steal data, or prevent an application from working.

The CWE Top 25 is a valuable community resource that can help developers, testers, and users—as well as project managers, security researchers, and educators—provide insight into the most severe and current security weaknesses."

And here is the list:

1. Out-of-bounds Write
2. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
3. Out-of-bounds Read
4. Improper Input Validation
5. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
6. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
7. Use After Free
8. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
9. Cross-Site Request Forgery (CSRF)
10. Unrestricted Upload of File with Dangerous Type
11. Missing Authentication for Critical Function
12. Integer Overflow or Wraparound
13. Deserialization of Untrusted Data
14. Improper Authentication
15. NULL Pointer Dereference
16. Use of Hard-coded Credentials
17. Improper Restriction of Operations within the Bounds of a Memory Buffer
18. Missing Authorization
19. Incorrect Default Permissions
20. Exposure of Sensitive Information to an Unauthorized Actor
21. Insufficiently Protected Credentials
22. Incorrect Permission Assignment for Critical Resource
23. Improper Restriction of XML External Entity Reference
24. Server-Side Request Forgery (SSRF)
25. Improper Neutralization of Special Elements used in a Command ('Command Injection')

CISA also offers an interesting analysis of the change from last year's list to this year's:

"The major difference between the 2020 and 2021 CWE Top 25 lists is the continued transition to more specific weaknesses as opposed to abstract, class-level weaknesses. A preliminary estimate suggests that the percentage of Base-level CWEs has increased from ~60% to ~71% of all Top 25 entries, and the percentage of Class-level CWEs has decreased from ~30% to ~20% of entries. Other weakness levels (e.g., category, compound, and variant) remain relatively unchanged.

While a few class-level weaknesses still exist in the list, they have declined noticeably in the ranking, as influenced by prioritization in the remapping task. This movement is expected to continue in future years as the community improves its mappings to more precise weaknesses."

It also adds the weaknesses with the biggest movement up the list:

• CWE-276 (Incorrect Default Permissions): from #41 to #19
• CWE-306 (Missing Authentication for Critical Function): from #24 to #11
• CWE-502 (Deserialization of Untrusted Data): from #21 to #13
• CWE-862 (Missing Authorization): from #25 to #18
• CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')): from #31 to #25

Follow this link for more information on the 2021 CWE Top 25 Most Dangerous Software Weaknesses.