For root cause mapping, CWEs at the Base and Variant level should be used whenever possible to ensure providing adequate specificity, actionability, and root cause information for a vulnerability. Class level CWEs may be used for root cause mapping if there is no accurate Base or Variant level CWE.
Every CWE contains a Vulnerability Mapping label under its title, as well as Mapping Notes to assist with root cause mapping efforts. The possible labels are provided below:
ALLOWED(this CWE ID could be used to map to real-world vulnerabilities)
ALLOWED(with careful review of mapping notes)