Clarity of Names and Descriptions
All CWE entries should be clearly written to avoid confusion. This is important for educating the public, but it is also critical for ensuring that CWE mappings are repeatable.
Based on our experiences with how people are mapping to CWE, we have seen evidence that sometimes people can rely exclusively on the CWE name when deciding how to map an issue to CWE. This was seen when an issue was incorrectly mapped to a CWE entry when the entry had a vague name (which could match), and a precise description that clearly was not a match. There is frequent confusion based on the name, description, observed examples, and demonstrative examples.
One problem is that weakness/vulnerability terminology is not particularly expressive, outside of a handful of terms. Some terms have multiple uses (such as "overflow" and "leak), and there are often perspective problems, e.g. the attack-focused "SQL injection" phrase.