To achieve familiarity, the higher-level nodes in the view borrow heavily from the structure used by Seven Pernicious Kingdoms [7PK], the categories of errors in [CLASP], the Genesis and Location classifications used by [Landwehr] et al., and the Preliminary List of Vulnerability Examples for Researchers [PLOVER]. As a result, the Development view can be readily understood by users who are already familiar with these other taxonomies.
With respect to navigation, these past taxonomies and ongoing CWE maintenance have introduced a variety of different categories for weaknesses. This provides a mechanism for CWE users to navigate through the large number of weaknesses that are covered, from a variety of perspectives. Many of these categories define groups of weaknesses based on common attributes such as language, resource, or consequence. Categories include pointer issues, mobile code issues, error handling, data handling, time and state, temporary file problems, weaknesses in J2EE and ASP environments, web problems, and so on.
The underpinnings of the Development view have been in place since the earliest drafts, serving as the main organizational structure in CWE until it was formalized as CWE-699 in CWE 1.0.
One challenge for CWE-699 is that with the large number of categories available, it can lead to inconsistencies in how people perform mappings to CWE identifiers. For example, in Draft 8, CWE-444 (HTTP Request Smuggling) was a child of the category CWE-442 (Web Problems). However, this category was incomplete, so somebody who navigated to the Web Problems category wouldn't find CWE-79 (XSS). In addition, CWE-444 was not classified in any other way, so a developer or researcher would not be able to see how it related to other issues.