What is CWE?
Common Weakness Enumeration (CWE) is a community-developed list of the kinds of mistakes that lead to vulnerabilities. Each weakness type has a number and an entry describing how it arises, what it lets an attacker do, examples, and ways to prevent it. MITRE has long maintained CWE with U.S. government sponsorship through CISA, the same arrangement behind the CVE Program. The list covers software and, since version 4.0 in 2020, hardware design weaknesses as well.
Common CWE entries
| ID | Weakness |
|---|---|
| CWE-79 | Cross-site scripting |
| CWE-89 | SQL injection |
| CWE-78 | OS command injection |
| CWE-22 | Path traversal |
| CWE-787 | Out-of-bounds write |
| CWE-352 | Cross-site request forgery |
| CWE-798 | Use of hard-coded credentials |
| CWE-918 | Server-side request forgery |
Entries sit in a hierarchy, from broad pillars and classes down to base weaknesses and narrow variants, and views group them for different readers, such as a software development view and a hardware design view. Each year MITRE publishes the CWE Top 25 Most Dangerous Software Weaknesses, ranked from real vulnerability data; SQL injection, cross-site scripting and out-of-bounds write have ranked high in recent editions.
CWE in practice
Static analysis tools, code scanners and penetration test reports label findings with CWE IDs so developers can look up both the cause and the fix. A SAST finding might read:
[HIGH] CWE-89 orders.py:42 query built by string concatenation: "SELECT * FROM orders WHERE id = " + order_id
The fix for this weakness type is the same in every product: use parameterized queries and validate input. That is the value of CWE. A CVE identifies one vulnerability in one product version and is closed by one patch. A CWE identifies a category of mistake that training, secure coding standards and code review can prevent across everything a team builds. The SQL injection flaw in MOVEit Transfer exploited in 2023, CVE-2023-34362, falls under CWE-89.
CWE vs. CVE vs. CAPEC
- CWE: the type of weakness, such as SQL injection. Used by developers, testers and trainers.
- CVE: one specific vulnerability in a named product and version. Used for patching and scanning.
- CAPEC: Common Attack Pattern Enumeration and Classification, also from MITRE, which catalogs the ways attackers exploit weaknesses.
- OWASP Top 10: an awareness list of web application risk categories, each mapped to many CWE entries.
In the NVD, CVE records are tagged with one or more CWE IDs, which is part of how the Top 25 is calculated.
CWE on the CompTIA Security+ exam
CWE is a newly added entry on the SY0-801 acronym list, and it belongs with identifying and rating vulnerabilities under objective 2.1, alongside CVE and CVSS. It also appears in code-analysis and scanner output in the secure coding material under objective 4.1 and in vulnerability management under objective 4.3. A developer or trainer who wants to understand or prevent a whole category of flaw needs CWE. An administrator tracking one flaw in one product release needs the CVE. Distractors include CVE, CVSS, which scores severity, and the NVD, the database that ties them together.